8190ca12e18403a5126cac3d6b00cb985ce944d02a7f7b8b9af5bbb36993bf27

Analysis

max time kernel
148s
max time network
168s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2d7339aee7474f9dde996bb9540899e5.html
Size

35KB
MD5

2d7339aee7474f9dde996bb9540899e5
SHA1

74915ccf183fe13a1deb9120db3b5329a95cdee4
SHA256

8190ca12e18403a5126cac3d6b00cb985ce944d02a7f7b8b9af5bbb36993bf27
SHA512

f63b79ff491b167f3ee974c464e522645e7e4e33b1d0bdfeb796060fc9569f0b88e6a502301b2ad33759fb61b0040bc72da3898a7fc2c951b9c8491850870a40
SSDEEP

768:Lv/H2mZsCwjIgaZqQLR9/QdqHpTCuu1lN8ztJtf1t6mHWvpfESlKD:Lv/H2mZsCwjIgSqQLR9qqJT8lN8ztJt3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000089470cc9d4b058bf8963beb35af6a74290a63a520b7b95d2005475b3216974bf000000000e80000000020000200000004a952ec795a00d18b853ffe059ed0c88a8606db329c7d650b609450db005c9d9200000005eca5b0a71bca4008c9e2b2ed8cd7bd334b5f81060175b1ada81842d53a3b3c2400000005cd3b54b6b0a7578d527ca6c32808abe3ca2993c7bd321312dc773722d1541b6fbcf4541cefc8b66528ab8197f85a3f05d3ee62d1870730fe8826507c8031213	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D23A5821-AA62-11EE-BD45-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c271d7b5a1de1b1645660d060c7b63189e382311fc09517d507678f1a1b0ab5a000000000e80000000020000200000003cc8a2662bf687bb2e36021e5ecc4250f12e9cb9294024b48e1e43d32b61e32a9000000072bbe25ec39605fd621a0b8153488b2ce15b0e61c51581ac21e8ba148fac44444790180cbffb91e7f3cb6ca14dadca4e23358855eb7b7b6dd05e8939f051fcd1d205deffd57f662e3c2282ba9b9553e23326d7107f1583981b55434372a33843e284472651adccd6677e7e783bfab1a3afb4941a4ac5a33fc3aba7194c724a772ae156a44945c3432955c4684abec5ec4000000066044476feda5adb892e2e0c61999d4fca5e46d4572a07b3a6bfde62ebafacc8b36be86419c4fb4ef44c1f06684dc7699ffddb8fd0e8de96156d8d8ca6aad49c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0619bab6f3eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410467061"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2516	iexplore.exe
2516	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2308	2516	iexplore.exe	28
PID 2516 wrote to memory of 2308	2516	iexplore.exe	28
PID 2516 wrote to memory of 2308	2516	iexplore.exe	28
PID 2516 wrote to memory of 2308	2516	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d7339aee7474f9dde996bb9540899e5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c479ef3a46c9cdaa8238ef7ed2e9c27c

SHA1
0acf6c82ff53d66f4a9e0c897e484da57a3d3e83

SHA256
2a74df4c2c52a9af6916a62236569f2fba56b1d1af4870948de436fe069f6d0c

SHA512
9643824e00477d504afe5ebe0b4e529daffeef3dbffa9c48987a06da4171452f9aec79b3477fa060ff74f2589636b62199d32315c55d73b620d8c860d2263edc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ae95b0eeed3e2ee8534bbb028e769f2

SHA1
9023865a720614e57c96140cdd24ec51263170be

SHA256
8864b712c4cdbb8474911a9d701ad871b66049ebb7295d080d2c8844ef7707c7

SHA512
aaeefb2d222e81a4e108be2f13094423e0d8f3bb243222ef831b7c0b888cd204130b05c1df22ecb37a2adc6210146ad61abb42908e7006f01a4df9d5fd52b6bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c24f43e63fad81d89f1966c52ae20dfa

SHA1
c844b6e02adca762d2246a1cae1d02958b9c9474

SHA256
bcc6a28d8eefdb17f2424f1ab38efe2081594c96ff4b09250a9f9a24d4d5b9e6

SHA512
ab21fd6001b0031987e85430d416aedb0481d4dbdeca441f733f9012504cd45cdb1d399067abb74d19192887c2f1f68166aaa665c8dbc4555385278f40efd1c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ba6ac252b4358730114c95602ccd5a5

SHA1
2abd8e8e3918f69e0f1fff460b9f93a950480198

SHA256
574b9b4edd1eb6886c89ce6235d51f4378e50e41e6c1d51b0e59e60e2bf7a0e2

SHA512
47627ee4dd721916c3c0f8c5eba9e181dfdff0d5284eb16aa2ee29d79e22251a775e974fa37d1d20e83a3b89a7aac9af03dc6c7b8b0dd5e3963370bb1a886032

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47cc5423fd0d92b6e83b3b2a0a18e427

SHA1
0d03c3e140cdbcd5622c2eca0e4c513127443ba8

SHA256
719951edcac4e2623a53d84e9bf2dd1c528e1b4cc049f780e63c8a93a2f96ed2

SHA512
00ca4b1af687c7fa12197b8f95d09f5e75e418e1bbe9be84be7415da5e0f7d2f7bc32bfe97235739e891f91de798d349c866ce3ec4239f2045581bc915d5d37c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4159bdb8ec4005cbce009f22de2b3402

SHA1
49be648d1083dbbd2274bbafcc9a84263c023f5a

SHA256
13095173d70690d5c96f63bf33712ed059c916ec6ea0caeeeecf586b29f77bec

SHA512
9b463dae2737dcd6c9fa70c1c604dfa6fd91efe4c1b095970984d296de3005673e87690403235c86d99c5a0fe580ccb6567f03305e44c2ddde4d49b9952a1c5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97523cf694bd1d9d345b737aab03fdf9

SHA1
5c45aa41b7d6a43ff0f658e804eec9106cddb4bb

SHA256
70b47113af637c9ed8cc699fa8e582b57f92d1d9fa21f93c8d6f0f588b9ac257

SHA512
982162b3f90c8ad92420c8acdd3b48a9f6fe15247e790afe3f1e39075e2e5c34aa597b8c8536b61b2fad2e0ddea77a84bbb8a891e9005a0f344881efaa91d5d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f91e9d5c59622b36f48053f30cce6182

SHA1
1187fbb98ffa81d303d89a0cc710802fd019b602

SHA256
0311b3a609fb7d11defc1d0f2884a056ef174bfa29d6a81896790c466b02fea2

SHA512
88cf95b42f1b1da0f02f43c681fc6b790ac1924cc717f8844d1512899c2f26c3b230e43640a9f66c278f81a0f78bc838569f6dec7655361596b2d926f4c473b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f3da077ccf879c0029555c3ac18ad28

SHA1
d1513ba588843a1617831327f558d776d49504b9

SHA256
939a0c8ed2a45770c6de6ea5ccc1662fcc31f705de8d307b26d30008eaffff9a

SHA512
baf32b986a42399d1b641f6a09662752f92707c3ed1d721ff0b18f5ada7cbea84a40aa918247dd1dbd32a193ade02c2e29cdfac577b7f1e8ca434c46243e5b90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21a780b578d12c091c86120f8ae45f0f

SHA1
3f8f1ab2334f777693247dae6fb1a7c6e86e0a54

SHA256
f2b16f7553d4926f8bbee148dc23ed79c33f37c33a4a0a7b890c5c2e402c45ae

SHA512
e06bdafcca8f5d4e5f262b9466fa878037684189589280e00fd7432bd4691d499e81264bac078a6cecca226eaa0e209946fe2b11cb52a85f54933a5e29d8564f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df11c88ec84298fa2ca633c57e4bccf0

SHA1
6a9d826da32a5d65321bf1ea3afbd4b5b26cff19

SHA256
4286e1cd6d52a3e9ddffb988bc5140ffe54687f74fdccc83ef1be8052fc986c9

SHA512
0a08c9e89de0304164c84bd736ea0091ab1e84cc91d92e15a2c00057e4f3ce5bf53439e729070d80058950eedea94857d4958528c68b7012397b1994d8e84ddc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8622aa66eae17616669d4fc55cd953b0

SHA1
ab2dd54e92c766c27e67f2d3c7e7d447f50bb5c9

SHA256
e683d11d84071ab63136f73af74f7777a8a6bc67a97ccca80854f8dac9cbe93a

SHA512
be3f38c8737bcb54e6c25d5ed71a6ca1a69475fa7ac801c4784eec9729a30e13220048c683d4718d32f7d4bd43403dad195e5b972a77519a06b6705b6dbc6578

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcbbfef41a82de93f12df0fb3a24807b

SHA1
613890a579485ae139e94d7d0a15dc799970a0b9

SHA256
f20d364c5aa649f81196f8fb2ded9917c444a58fc9890ed1b071fca2fdbcc5ed

SHA512
2cb058d05443fd42f0fbe168653cd14c86cb27368b10c172a54b5418108548f8e81c4f0d5d1521a3e1bcd851a7d5d2d1feef57899b4a4eb310849e257ab0987b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8d64e7488c270ea27b7a5143c064f16

SHA1
e9bfdaec7ed1dac52c5d269cc56b8aaa3835d343

SHA256
5b7901947157fe3a98f68fb3efbc0a71c525881ae945d5e4efed8a9b93f1dc88

SHA512
ada49b8beb528b075e18c8b6707f4b271f59b60015fd5496fe5adae76b5dfb6d24ead8c42b8f7010e37ebff7d683955458226aa2a12ee52f5b65ab0429eec0cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0a71b7f1ed908ab4f0ba629f6a180a1

SHA1
88700919696ff93a770a63c9c943300ef0a63559

SHA256
dc72b9b2e722f65926effff935f6a2cf9fa446c3521d0e9aa42b3bea5b7e8efc

SHA512
d3849bba8d470aac577bed6e4bd7215417e4592320da62030fd434889d8739ac072569436dd71e860d53131e7f167b7eed266eebf7d31420607cd145651aa4ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b373d9fde550e22b0bddbadfbc730e7

SHA1
354860bedc358524ed0c16d1db82488aa9da5912

SHA256
9fa74d192751a9cb6e88ccd0cf3e77cd171938ac1b2adc81e4340c94c660b4a7

SHA512
0930619fe306bcb7fc0ab769d14251c78c4d9ce4f3ffa10703e9541c03c1cd39c597f8284abade56d1b73f36d8420c150a7f20e66d75ebdc9a4d4989ce7811b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDD17.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDE52.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit