9f788dc26f1dc8b22003f979cc954c9b4654bd09553cba0bb8bb28232510df18

Analysis

max time kernel
147s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

375f3176b54fcc6ae8a9704c668404f1.html
Size

650B
MD5

375f3176b54fcc6ae8a9704c668404f1
SHA1

b64993207bd45e2751f968fc11c1af2b296987f4
SHA256

9f788dc26f1dc8b22003f979cc954c9b4654bd09553cba0bb8bb28232510df18
SHA512

8eb2a2c41d158aad437a5ca190c47bd508383853505a580470fb36f8a3f82527c6647e5fb142a869f7a2372b729c94867a33a2a0c445ed7b73c9d558ca803988

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000083907ca6682e813eeb13578b823165b4e3edee782dafbfab8835e5edafc730d1000000000e8000000002000020000000f16ec9faa55d57224a06f3d14796dc379c3742d39de4fb5cc064266cf9cac8e92000000035936d0eb7dc293e8c266057e2ef5cd9f047760b43e49c0849a9167116aba7e140000000a019326495454995e32eeb189c8e22c4f2f4c5777df94ff2e8050a3d12ad06b8598491965c077e78b9297bf5afcdb0bafe410f17b09dca6ede1225a3eefbc9d3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d7ada3e243da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000005525e8ee6f55b47ebee6a34165319f516f36aac554b69074b022b28ba5288ba5000000000e8000000002000020000000a3801f2762ea2fdb8f25055647be8f67ad953f918de2f20933f865b328f92ab390000000ad4d8bf22ddcc12f5e7c19317206e15aa8eda457ed3246aaafc0d6c1f61316bb2579c380bfc1c90e3849a5df5ce8079e429e6e571d0b422628667040cae49058becbdf65026ac9ba0da9904780208a8a0301db502cb992edf7244db159578ca2c53cb18fea3c4afbdaae4efa6302e5aecbced7232b41dec0233e38863e168e20614ba9e4d498b4570e461ffa8473cea7400000006646f4d5da7761bc2e9b376fc7f1089bba2e827486af0c39bced7d1c712bcb579e96b8ba9fcffa2ee66fb4e80a675b2f62ea12314bc3ca8c4fbb890b458f1939	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE2F4011-AFD5-11EE-B9E8-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411066211"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1720	iexplore.exe
1720	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2248	1720	iexplore.exe	28
PID 1720 wrote to memory of 2248	1720	iexplore.exe	28
PID 1720 wrote to memory of 2248	1720	iexplore.exe	28
PID 1720 wrote to memory of 2248	1720	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\375f3176b54fcc6ae8a9704c668404f1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a930415e6eafa857261e6cc18a710ac

SHA1
0b40f88702ea1b03839b589cc825a84cc683de1c

SHA256
6a0794a9a82dae41d18249d4e514a08ac17545a06f65f0ab260cad89c2ea6a8b

SHA512
7377743ee888f8ca0cfabec63614326eb8553c18b6bac46bb5b1cb2039c75c6a818e9ec8787f605bc69b6abf0addaeef74bb60afa0fe5ab3bfa9ff2fbf622346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b1776544ecbdbbffe68267aacf5c4f7

SHA1
2f67032ded8602fef0395c12d039059fcbd6d390

SHA256
cabce16a7f9c2e2216475d83c5c089b32897ee4c03c4568005d55a855b844b7b

SHA512
7b91012ec669e6f61b0359a2f292820d027b7b3fc53b6c54f5faedec384ffe8eacc11db768b78dc1433052ad2cab73e44bfdbbf2333497a3b40bed6d33b57227

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
008a169aaf422ab0ed2834ac2b9467b1

SHA1
3fe09204fd468e43b72afe5106f49f62b31f1289

SHA256
707db33c90343f092439a52785b7ab604e83c15b3740986f0985a814f3129188

SHA512
d9acd6cf0fd0319622427d1273739018efbb43a1860fa809296c9bee177d4b9157c3052416328160447dc6bfa3c14c665fb3fdca06b90298f6ae23b21c044bee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7de14448e68f4e45b3d2225a0d87825c

SHA1
74ac999a116c4e29531234f74c648b77c6bdd0cd

SHA256
06d151974330c31e0697ac5f5354cf5251890bf3d2a29c1f0f190a648d422d3e

SHA512
1bb4b33de5409a54ef15c579c8cf1fe6d0c2cc86e18c13cca49051157dbf6fac1cfb2dbb747acd3f697313072e6a990925f6e7d6b256552217d44544b79fd205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3843bdacd3b93eb34b2701093c11be2

SHA1
c66e4a1aee0ccd976b8c47001ab07e4fb9576409

SHA256
73b9f9342fc9d6953ed0127de1ba918f4d6af303b8fe64acb5b2c24b93d6cf42

SHA512
993221df162dcd548f80329200fa1b9d1832fab9c07dcfef26b6e10cd4fa1ed414ce0d78899e5bfb706e60550fcf8c603c3670c55ba777c934e579998e6a5f6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d732d5d2fcca7cd8d0470d251c2881ca

SHA1
9f7fd32dfb80cb051d34dae16cef5119c4c7b1ef

SHA256
8f33a56aaacba4ebcf5202e8596d6d387225ef6a8f1ff7979fe968b9663e25a5

SHA512
481b5f788df01d5bb2dbfef8bf8cd191290d837602dadd9e0380b845ae62295134a91ba3049a9590cfbd10345156155abd59b54064023aaa7bd6c94b6d41cb02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac58b949127222d0c76646df2de53abe

SHA1
b3006d08f10f3c520c0224fd2d8e0739b2bdaa75

SHA256
c5c5fb043570681596fc4fa0f2c4d04838f74a2f66820a9025eaa9e844a79992

SHA512
54fbc869f6b17242932f531a0a5e2c884e58ca24d04f509c918ab3954c3e436e89fa6efda12d7bf1ac9437d1fcb36fbbc45c658839b733e4125c6d83d1dd1125

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20ef8ad100ba24494c2dbd72b87a30f3

SHA1
7be437907a8ce7a9249a5e845761155788fb132f

SHA256
d8abdef5fcc39efef212d76410c17ccdcd3aac8257c187e3bde35b0c51d38bb6

SHA512
d65af0acb11ef0fe3267548c295a04d14a1ff65074814715be622e4140fb032001795ffa64f23313bc93057504f3ead29c4c2e3bd1e9d0945e3c58ede4670c4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d0151bbde319e047a55a3da60bb487f

SHA1
c2b604aa973e831d39bab5aa2f83e7cb1cbe2ce2

SHA256
83e15cca290b32da22b3cc42d8454e1d079b53711d3fb347921b8775ca5bf8c5

SHA512
d585e7bc8eb5e3c3635b026d6ed056e40e4127383c94454221b9a75c0dfa04bf04c14abc7485adf4af4345d26e90d170c1c530a9bc2a452f2c602dcd2b119cf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f9af0054ff23cc9dd7ee1707cdf5fdc

SHA1
11782d7196390574f8852b94e02c013649833f14

SHA256
4c9585b43ce99db8fc50a6d86e397af0336f94e72d0741be2a7c8abab3b22719

SHA512
8dce830db9a716bd494bf5e3a41bf8619d03206718e29329bc7306a4f8fc12f0e832b6da5ff76a99bedbd717a6dc469bd762b164f3cc41c4a487ac69c7cc6d56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4b90cad32966a212ca91b72585285cb

SHA1
738a18e4bbb8a3b5e6bc54722fcd03bba7bb071f

SHA256
14ab0f41b7aebdf4fc7b91327a0cfc56df331824a63eee7a80f7febf8caab807

SHA512
b83fb399b35271399d598700044dd1c146a543234b00fd7136decc746a9b77098e7a6aae5c01ddd6e97713aecd9bc02bfbb648ba8ae00c856c36a4ee682da931

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b23e708799492bffc7ddd4334b1c11c

SHA1
bdad87300d8aa0cb0ca4fe5340bf06f6e61d01aa

SHA256
1b928975e0dd40abae8bff7a4607614de6a440ccea661cb6c9672ccd6e7134e9

SHA512
16ea65b4c9665b55589f7367796c2e7dad686cc977c6db441840ba1c6d4e41429f943a554fc7b9e5cba8c503ff7ca31cd06dd301e59f2bb83badcf7ac9b2c234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53f1855ee7c4febf575211360116a807

SHA1
ea340ce8900a35bb774ce14aa8fe31047ba5d2b5

SHA256
0375d62a9c163f5e880d8ef5e1ab8ea6c7bb542424867b9b89c2d16238364ba9

SHA512
3c1cbb69bd42801fb1c8bfaf8a661e614f269d0410cc1f9fd157e29482106d0ebc82182713b451b6fca1e731cecc8ca3b1e0c686a927573528b774b498879cf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13ccd655a15669ef7930b94e0fc6e87a

SHA1
6d2ad5601b091ef89d7a78c6c22995fd33f208d0

SHA256
bb4a2ecdf5af38793ee051d7f9387b94cf84d9299be2b1876c37bdfa39a90fe7

SHA512
78da543243c56a8b1e50e41047792ecc52745f31e76efa977e84c6c5d630a5da68abaacd7b7b2aef7593acae482448c48a768a97b02b43c9f9caaceec8071f84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
242e4203aa9f6d45f3fb5e35b9123c7f

SHA1
66cca9e1ba59675c4df1812f9b1b51bc33e493ab

SHA256
6d59b3aac07980282f9b38c099258a2c59885aa4ff4fc83efd0f12086743aead

SHA512
d90162c0f1b2c13ce5a1f267f91f2a48bf4a92c1a5588728c349aaf996f826041943fdccf733806329952d36f39b98293d597d26d706308989652ce321655104

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB915.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB947.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit