e2812a3ef5e51c8d5b7cefc7d560d1102cc96f346b412418d1d7ca582b4cd00c

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2af6adea3d4d07cdf7228ed744b92134.html
Size

56KB
MD5

2af6adea3d4d07cdf7228ed744b92134
SHA1

463b0d11aee485b1d1f9496afea80823da1261ab
SHA256

e2812a3ef5e51c8d5b7cefc7d560d1102cc96f346b412418d1d7ca582b4cd00c
SHA512

49ebada64f24cf0e0d9987a6654221c471fb1e28bdf1d8c82ee91f2bc516577a9818db69cac773312c3795b39229554cc8027b9b7fa25f476ba573f89486b055
SSDEEP

1536:gQZBCCOdJ0IxC3AsQ8U/SmG8mS18cA/+kH09sMhOhhaKFpDWsQJq0af/pGzzOdo+:gk2D0IxoQ8U/SmG8mS18cA/+kH09sMhE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40b5ccfd0040da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000002238569e97596914afa72f09d601d54c6b6fa7fc40c9bd50d50ea3bd83e462b6000000000e80000000020000200000006df7864010036787600421e1f50f0c7e0dc1311dcbaaea0815d0d6794553dfd190000000979598da0644c935ff1f479d7ab86647377ae033833b9435c57e97217c28f5894e623a04fcf333470550beb69bd4feea7b46fc02e619101c8708995fe0f174891ebc1c52c113b946378046a8c497532334445489a9d8f1188ca80e505a4f436516f835ec7a4c77c4dd60864c4a14d0aad0ce97d9c29f8dfc0cf0450817e6628888760fe2da03a6f8ba9e0acfe3b4167d4000000043eae74100c10251c4c497d076e1945d2de44416f9c83638fa0758351395356489dab0911ce636a0e4ed3a721738a1f5f69a2521bc464b4604c6c773b15421fd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0DF80501-ABF4-11EE-839C-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000007a8791c1d762750905920b9325c9729cd2da671b8380a7f5860700bb5de5d45c000000000e800000000200002000000099d412d7b4219b18e4e7e238bf83629147e763c9aabd86baba1dae9319df957a20000000685cfe43f8a77d13ae272675efb3342fc66f2ef0abb97a5ce5bb48a97133b3e340000000cedc717006fcda528c38a41b88665b419fae032989f2b0cf47f4b8b6349c56a7630f6f0c355d758f9b44554e7e1cbe86b7df71a3e66d3730a1cb4ca40def7fbc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410639420"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
836	iexplore.exe
836	iexplore.exe
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2452	836	iexplore.exe	28
PID 836 wrote to memory of 2452	836	iexplore.exe	28
PID 836 wrote to memory of 2452	836	iexplore.exe	28
PID 836 wrote to memory of 2452	836	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2af6adea3d4d07cdf7228ed744b92134.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:836 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1788748ac51b29a0ed84343a77c26501

SHA1
3f35ab0c9efb27a2dcc3bc1df4de2c179b5dec0f

SHA256
d59fff2baa06fb43e89f9356bcb3aba4c5c388b839435ebe4547a1e618979427

SHA512
f6608735d6351cb60840984b4890e09273dbda5c40e2f5fb693b92c736de94bc9d38c50d421ef00133ffa7814d31258fe37e2d84846a963402f9c8bb96872462

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e11b9183cea80688b2ca00f27687dd3

SHA1
58714c45fed175b1ac4b386fada2b277566ad526

SHA256
7814dd60d8ea896fac146a389359539640ffca919ec5c52063a2673ae7a891c2

SHA512
4460c635ab31890f84dac03fbf86e9bd49b8c3ac9bc896a6596e54d27b30c6f87031560dafc0062f7d57a9f3e2aa1973610859df7ed2f4d025df84eea6401fd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54e9ce795c6c362cb4284c227e0742d3

SHA1
0b98135a1ac24baafeca2a9ec24e632695e9a0da

SHA256
90b25329533a7fff5df613612e44cbe18dd7340d8eb4dbc5cbe968d8c52358ae

SHA512
911852aa4476e2441169d4ee4cbc994a8e46206219cd34197a717600d248a541ad21c3e9e750969257914381ce17208abc99201f4854141cdf7938d0f8778db0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45b7749bd51fd1d22861c61b4e00e0d8

SHA1
807e56a5ebf67f562a80db388a868c730b3121a1

SHA256
c20cb2b183e5c621c1d8225189d88a27e8989581b2db35283b048e8f9188e6fd

SHA512
bf2e8636698b5920559501806c9bb8418757d4ef8972cac99a8bfb4d59f8a5ddef5bc25d53a469766dd60ed4bec8130e9f35d9e956e63b928dce98a5f953a6c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48d397b6a15a801261f1b1542714ef17

SHA1
f33385e7278866d8bfda6264b4907ef99c36c3fd

SHA256
10711ddef27945d9abe17175f9faa76e4a71abb2a1c55695a8c80280064826e0

SHA512
857ed7116dbfc91915421578f4fdb7757c4ae3cd05396a570e49e8e1c151bf6d0c321d2a9d2ba78f05d1b802b271b0b5dc5f3214bd426e967dc2252975062574

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4a3915d8e07f17a9992fa2ab087f592

SHA1
93043daf2a5af68bd12fac5525b40bf206471ba5

SHA256
6905c4887cd32c289a0be63ff556dc08b9452ce0fdd8fbab6989fcfdcc749043

SHA512
f904b3cda357da495de9ffb2ebb03c419f4415a8cf2e10a5ce1a9740a07c799a2a486df54fb921f3167a9b12ad5fed628ba245b28ceecefee0968317d91e4ac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60bf49eaa4b75cfcf0368eb2113b76ae

SHA1
46caa66244f69b3c5b0a7d7eadb930d55e8b0adf

SHA256
d8caed5c38c78baa626617bc1b379093b471f794e7b572046fd6bd12c4d1560b

SHA512
7a3dbccbc557c73bb45df2ddbfec6addb3d29ba894ffa172354b06fe7fbca68598cfec08aa6a7c6437547782765e7a0e28758f75019266a170336e70e3ad0ccf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
489cb87d3258b21061d2f3b3cc4f6742

SHA1
88f6e1fa64ab2214c51bb46eea312b953a90994e

SHA256
9d5c1230fd82dfdeb8d77788783a86721b5fb7d2ce8d9be775fb321f87fee804

SHA512
43119468360f3966be971e378bfdf3c4be90417eea3168b9a72236cc63ae9e88862afcb647bc3e86dd0f871a637aacd57527d8c20486e247e707e4722aa8d4ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ca664e40fd22660f18f65f7879e4278

SHA1
9599796978bdae4073212e59b340f9e9c53ba98b

SHA256
905df30110c9ea64852f789958cddfd29fe9bea6392b25e87b1a6dca9d565dad

SHA512
8872c2eba35c0debe224600b2fca77042b592283c24f98c7534dcc65484d5cff310b10d600485b376339fd0ffb1f15e848edb2b5951c3ab78d8c115c7f77f1f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96834400c11a91b1b892bccd453207a5

SHA1
845003b1f9558f649c56ae9e2e648b76b7844274

SHA256
571fddeed41f98f79f228b7a75fbae644b33233a41f965a3c298c8778785460e

SHA512
9f94cff6cd7b852347ca3a50520b6b5690b6f1fb411713f9e7c642d68f7cb6493e774bd28db8715cc70d684b1b354f772b5e58da63406790a49ddf607381abd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
133766dc0cf1f720b8762a27af12986b

SHA1
a00f2727db962d55870833c8c82bd276304e8070

SHA256
2746e84e26c19665b8f2c9e4ac2c96e29f5468ff28d27b861424319c7f504f98

SHA512
238b5ef353acd54bfc4f178fbb23b7e0dfb3184497763713c8e74c377f466284c7e1e03319e3ad74ac9b0d854c42185ca0ed0774e2520578a08fe6fe343bc3ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7ad6d80d71f008ea45083a7213d5c17

SHA1
a1a84318a16f87eadac3526f58246f646401d364

SHA256
469b6dc3a00e0cde0f3233273fe94b70a768a9458f8fbd75018cb285f44bd2b3

SHA512
1c6558dab161d29606e8a6d49b22f28b5a94742097178f91ed797769047f226ce0711591e107956aaa6855de2622163f265d28219e0c511fa1559f2c3cfa7eee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97eeb92b42e1447fd6c50dcd21f2844e

SHA1
ad0bb4737a3325ab30f107064d87102200bb9339

SHA256
393fa78bf2b58d8ed4acad7cb0b2103a9c23469fb35c3c33ffed9d0dcc57d5c9

SHA512
784df6db05cd9882d2d96e09e2788194b094251d27ab95d351fe3f6794cb59608b1a25a082150bc7c9e85f270fb075979896cc35183dc0f1e767e7d183703f31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab64BE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9236.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit