4c1fa172a09caa3b63b178f2b12bdaaa7828e19e3a31e7b7d505cf07e92a3fb1

Analysis

max time kernel
138s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

395ae5d1aa23ae3263b9ad5eeab68c6b.html
Size

24KB
MD5

395ae5d1aa23ae3263b9ad5eeab68c6b
SHA1

5a2e40e05df386e5a7d4535ca592d6c152c8f100
SHA256

4c1fa172a09caa3b63b178f2b12bdaaa7828e19e3a31e7b7d505cf07e92a3fb1
SHA512

3531f6c4e85f95065e14650364df53c3ad9576b83e17ec72f81ae431be07e594a8ea59ae91cac9cdca293f1f76591764947fac292825a922729326cf567bb932
SSDEEP

384:/X6qUVkczFiX4pmOdOiuoNo9oD0Vpt2D58tAYsNNBMeo8BYU1ke2D:/lUpzFiX2XAt26thBeofL7D

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000072b3022d4bcb30ab7e42a9dc173f325990c5d87c13c2d98e262d3193052533cc000000000e800000000200002000000001c4652278dde3b4f33e40cf4207b0df5f1b08c3847e29f773b740ac0f29010a90000000a7c3b284f79a5c6a7fb67853052583508d8f4718a63641480ad458972f7eecb02bea9a50b6f984274025d57fe06fdbca1350f880d637f307a63437bbef8ef389b2f2940e6d9964ceffa52ee9ba443ef76d014fec5949ae7494e42ab37f81844d7b8bef9c683f304cd38f203ead898ab937c6efd9796e033cf9de419b5b9f8757951e090387d8da60ed9c0183712dfe7a400000004e78b2a86ed969e2f3ffe7eb80d6466f95950e52200dca789284b19b3f968b39c7161cd7eb65d3e557da513c6644f4a92867dc00c4d368d9f7a776131783bc7f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009cdcbf597b44637585c6bfa3865d97b59b0391f1d114220cef86e01029f7a904000000000e8000000002000020000000a3cb7b044d961957175f702b939a9fc4323dbbf92901088e0ace71e87a2ce54720000000f1a7007651b6e201aa8cde88f65ff5582951172554dc5e1c8732dc2ca251834540000000683b199348745f10eae5ab880eafdb325905ba41cd85fea664a8e2a37410db925df5e3d721204e26c7361b54b4c10999755cf7f8f0fb5944006dc89c1d9365fc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C2290F1-AFF7-11EE-BC40-6E3D54FB2439} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411080722"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b7e7710444da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1180	iexplore.exe
1180	iexplore.exe
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2064	1180	iexplore.exe	28
PID 1180 wrote to memory of 2064	1180	iexplore.exe	28
PID 1180 wrote to memory of 2064	1180	iexplore.exe	28
PID 1180 wrote to memory of 2064	1180	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\395ae5d1aa23ae3263b9ad5eeab68c6b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f193318899d12165f5f20341088ae1ee

SHA1
3895a85149aa5d6c6cd2173a6fbe940d89fefc4b

SHA256
9dc9badfe9319257a3ba4646b744144a3fe92454ac1a63461a3179ecf669e2ce

SHA512
2b58d6f9b5cae5731eafdeb2d9b8362f61c3c0e44652ca8db82090c517f77afb4b9ff100f11fb726bbd7d75c2e310f093d30364394852a326ca5ff139694665b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f12597886044e211751f392a674192d

SHA1
b4138d99e74ba262febd5e02af9e51fd66909937

SHA256
558124ddf821b479da0ebc5ab15c78f4dd5cf1cd66143161b257d8c991aef624

SHA512
a71bf8c850890244f032bad7a3ca657f2a1eb79cdb28611554704f047fe312839946824f27bf6c1b3c36763850256bf17b369f32af22fc02101e81691e30d198

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9244a02e78efc3d41e0237f2d252de46

SHA1
84f1d97d5871e7e215e28f2ff39c5d2cb6ddb4eb

SHA256
09fa35dc46ab27f5e1c46ccc8b97a3116f7099115801fecb9ae37b1769993722

SHA512
94165ba1f4d6b3c764574f67fc870f98d3505cc6f76cd3b25c9f4f2844bbc9b7b148e328be4bb7897fc7b3f27cd22b3b82d5cf4f3cd485f99ef1f190ea6bdc16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db043c769d420ebfe4f640525364a72c

SHA1
6a977e12794e05381435ea689e76fc2351c82c7d

SHA256
fe6605807848dda50e7fdc5f35b89c2814afda2220b7733e0cc0230994232d51

SHA512
7803f21edf4b9ea36de3a8b6d4be2aacaa0dd7db69e4e8a78b28fdeba18cd7e36e8602f8f915b3b6319fc224084130ce06589900afee84997546abca41e5cfe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1b255fae1c7a6ce2a2a761282b9f266

SHA1
03c7595cbb051db1cf2bf55e3609a7bb5a1d9b98

SHA256
10e65db41f762047851c4d23a5ec420bb017c00c9f1e4a72039d5df4f2793d8a

SHA512
a56a4a98eda4017ae6882c782721da93b7e29899ed5131662c47e8bffb6d430ebe55e6e14a15441c1ebb74c6847bf5ec9115d61ad690b2cd2f2d932cb89a58ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0ae4eacd4d9344fbadb6e32f4ec992d

SHA1
823a3a1236a86fe81189eae284f314a92a55cb20

SHA256
bc32437301191489813058d1b2889bcad958c3a9e2b6ee67a7e58d66f36aab28

SHA512
54033d8cceffcaabef135a8dd567824dac45eec61d2bfb347f40019d1eb6eef5628eeaf88f5b6e5d520e662da993b1fe8d37bce52e106e9493a40b8874ba9a65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51c3110cc3b3ae3a2e0d4c2acedd8c3f

SHA1
094b743fe3225c7dc7fde077f21fd8646aa5d5a6

SHA256
80ef786e3f752585ef31e4211c1264bd8b0f7307f9d4ddd04590416f9767b054

SHA512
6701fd619b03fa2fea1ac0521a634bb76ad670e170f8504df98fb66a3c6a84a29f960a3ad4db23a3d315a0c7c346d6bbc413a955d29f69274c7fdc4e17d2ce0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
024cbbd66af2fb3c6e199c6a3abc3fe0

SHA1
6d344e22cbc4204e29a7cb5814fe0e937580e56b

SHA256
2777dbf8f867daf1f8032e1ddecb9df6ed990435f89d0fa8b141d3b2ba592d3c

SHA512
60b3d9796210d50050cdd41de596a5c0e79f9a7a98d78279436eec6c0894487ce7eac65f3e603393c694a5f12b7511532cce44b3b805f8f0d8bd5d65badbeaef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c195b5e72dd5be79305b5d86e0580247

SHA1
2d235c973b2dadba46c4fcaa8c2c3d113f16ddd7

SHA256
dc38fbc7f542f1ddd01389e972d5d33eb8d789653e486fb81c168a5ca18f5bee

SHA512
15651fd02431e91d1be7220585a52e889edbf749705a5ad8ac9621c76a80fa7af10152fb7bdfa69b86a4c1bb62a8a4518485681b93c09d5136564851e29ff0c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
583685638f8335a7e013c0f48bb73699

SHA1
be0506c48e2a0d13b6b0655de2de80a827a62c5e

SHA256
851237b760a6b2aab824b15034ae452bb1ca12d51105ba3f60d62d0b385a283d

SHA512
d2547f1318d4351378ffcce2654154294ccdd36c5ad744ad2c9982aa0658ab18682d0bdf4cfe3b28eee69cf955fb6723ce7ce240ba483528986a4ce06bfb6ff6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9e682d5e30a94b2dcb7763b01e28a25

SHA1
3b4c815c996fdead3f679b2a96ea266c6d18bfb2

SHA256
7a8a9127ee8315ba41c1f037fccc552466f9376d29af7563902595c370075936

SHA512
4a341def267624c3f376e433dffbaac531110ff361c9fc7bb56feb34b800eae869b8faeaec30266bc993bc965af676a2857506cd21c7b0f6d9ce9e7e6fef4680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d780f8a7ca7f97ed178c184c33c8df4f

SHA1
e2840a4b240781a610883ec2a80e754941d288f3

SHA256
6252bdf50a21dcfe501ad9df085e35b0b6751331243a6e39ccac1b56179f3670

SHA512
2189aea67152362d7d2c192800de677979406d1b7cffcb3e84b6d485617c6ce228a8a128f3818f63184530835681c6f5dd925490b95584b96ce03bae5dfcb833

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea1c380336d064d26f942b3768f08e5e

SHA1
9b5f3d47f8ef2e2d0da36342acf4f2fc9dfa968d

SHA256
30bccb5718586018254057f874555d07f5ccf61163d61bf83a156e18d4dd4d95

SHA512
c11220eca5065e6adb52ab3d672b8ef092b03e3696f7516e1cbf3581530db7324382d9eb5816b36c78378e12366000577ecb337c440cd88504c40781de310b4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d38d7449987309e198b0450b4b6396b9

SHA1
702499571689176a219f44168a30b36d5dc0923e

SHA256
1854ca266b1639eb4a4802de70ae639412912422834a001784ef8d1757b60453

SHA512
f0b08789bb668c84ad2640243115f3fcaf337ff6a81cb8eeb9dfd883ff464842108f6acfae41851bf10263ca68c765493b72ee860074e984c463fa3882fe5782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
310501fa19386ef538b4de305868b483

SHA1
6a6b7554b18480db4513e413d9e984fedb86601e

SHA256
aab1b51428a87f38935862aae42a8c46ed5e0ef23b4effbe24d8bc59f15b3814

SHA512
840db4dc55f0ecb2dfe0167c9e88e8d43f0f5ad0b01a71ca44bb3482bc99a1c48e8f6fbbd3ea0ff1b9394792d36dbb2e913ca3a0578ed13409bdd98fa2e78f7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a5826de355b34d9f46304e40ea49a73

SHA1
53e23b0398762259591aec24ea3b7c36606be4ad

SHA256
dbdcab9c6c241702482e2897b633dc609b50b340ea7ea5cf231a23fa69e31783

SHA512
6630e233f3ef09c7f82b3897b4aa6876732bf0e0360cc33e8fbd7fec47ce2873df211ec94a100a79b523dc0f7fc22168ed02c9ef5277833e048a5c764d692c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEC83.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarED42.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit