773f0158d4352c0fd8bd07c575e076925e7bfe0a2923537b920a6dd5c2373a75

Analysis

max time kernel
136s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58870d9f028bf47b9ad8c70b75188b8f.html
Size

19KB
MD5

58870d9f028bf47b9ad8c70b75188b8f
SHA1

1e3fb8056c0d8b6f929c47d8203a20663f4d2aa0
SHA256

773f0158d4352c0fd8bd07c575e076925e7bfe0a2923537b920a6dd5c2373a75
SHA512

7b947098c86e3004494e77d50ff1841306b6ee269de8698d2089b85311355bf692098a86657189f98aea3eb667274a90541c2d59f22d6284d9905c013e439c77
SSDEEP

384:gR2cgQXXlCLiMOY8KpTt6t249hHc9v//J9LHY4QDlKYCMCtOZEB:gR22uHEtDTCMtEB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000ce352901ba409c19c363181d6477b764a5cdfc8ddf0136942d1b2f4cfadfa428000000000e80000000020000200000003a1eb9813bef43ec9667a45da6f7a6a60e7e9f6dd194252c308340b5b9a7fea690000000bbea18a6485f09c04301caa92900971b432a44e4f18d0d94d7129d6e7e375867f2c626ee48d0b0895e71e2a33ddc04125412dfc85206cf364ac08738aa0c762fcd8bac59b4782769bc728fd1905eb3f7386d5bc4a7869b5dbe10bc9bcb2d4c09ba549d71040b7f406aa4103b69d006ed075719c8b5b5ce33793eee42189995e559b90227cf77010b0348ffdf4046057240000000187a0e708d65cbb07a2c7d0110b005aed030503b8fefa0bd0ad83e4d80a3bfabc1049fe7bb38f16ea6ab19bbe562b4b80322d158232fc51f9aee64a3b3d42a49	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCFC8251-B1F2-11EE-9439-EAAD54D9E991} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e9e6b4ff45da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411298590"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000006e0ccf9c4c83d935df7c77f00890be46650689e86270700d15a47f57843f6a13000000000e8000000002000020000000e48e16f043fc9ac841969d2a7299649641589998b26ddd8ea013a9052e3d3ca62000000062bbd66b472980ff023d28f7a6c53b557c1e7737c9acb73693557710a06efb784000000012567ba51c8af6d7e4ee8bde599abdd7b4fdc8c6cca53f0ec7dcb949001b0b0c096a85bc4a7264ce0ff7e84a7a6eee9a7ea0fd30252c3c059d5e7853989ca9f3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1900	iexplore.exe
1900	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2208	1900	iexplore.exe	28
PID 1900 wrote to memory of 2208	1900	iexplore.exe	28
PID 1900 wrote to memory of 2208	1900	iexplore.exe	28
PID 1900 wrote to memory of 2208	1900	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\58870d9f028bf47b9ad8c70b75188b8f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1900 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec1ee24ff7f5ef69a4191b6b6a7a9340

SHA1
4bb1b28472b138c796d2334ea0c5132c5f1504cc

SHA256
ce2dafca1d406033176ce01a4d01ff7929752215f9383cae041a6f9b4ad9b9a8

SHA512
11ebffd391ec9e1a6f929c23f5c0b66cc57377e2714180fac7323b477566181636db51f5e050555cd1955a2c2990357aedc3aafd3c37f4c42b7dcbaa31e0dbca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da8bb684f72db64169c1cbf4f03a247b

SHA1
a05201803a1f8c63e3cdb950806c91cc70dd30df

SHA256
03a115fa252e12d03f2c7a21b56afc27fdb6785e7bb1670e4034c67998988c44

SHA512
3b4dcb4159b341caf3020caaf5a9c032cdb43e9b2267291e21659289fd1eb1358ebe2bab4215959588d2e15a355930a70b6769b06bb645e3fe782c8ae505ee53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
527f34c0290414b74906116a41074d3d

SHA1
8d31cb98f38fd095cecaab160832a2fd76355ae3

SHA256
7e9a0dade0a3abca4ee37bd92e60c9760721faf89fe7cfa1ceeb7b078a17aae4

SHA512
c1663ae10c97249c7d5290a635f9916d2b9f535e626e0497afc94291018012c46089916be2782ded6d6b95ca2f5749b81a8d321c4b8faeb541742a16635659a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5c5bd2223b5a7360a47833fe7cf3dc7

SHA1
ec34d9ff5c97462896900aedc493c9755cebb8f0

SHA256
34865f38cbd951a8f150f57033804ce6c807c1e94f0ac47b0670f5450f9dad87

SHA512
6b4d40b5d99d612b862faf2a8fe14bb2641923d15f3085fd0c395793b6564aec8f20c80684aac2dc88d8bfcc425fd001749e2a904c4c8944607b2b85ddea534f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daf725e0de369985894b7360bb06b6d6

SHA1
0380cf6486cdc22d0352f86ffa152f01ac3904e0

SHA256
a73e1ca62cfb388770b3d9839bfff6f0807e37935cf928370780a7b98cd40594

SHA512
e785e42f8167c20dad736d303d1804cbb7deda6f7a3a4ce959f1bf68c0e03fa7f0348ec03cf596d3d469c0986125881bf22a45af17d88a5bac113a8845a22072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e12cc58d414b7f5a42253933138cdf2

SHA1
1fdd45b95cd90363713b66fdc78477dc491a83e8

SHA256
cc212b1d621c22ae6569b8cabec6e43cc47eca765351c0c5d633b3199e5184b3

SHA512
1cf12180a96d30373fd2cecbb1b872418b985709f0a706e69bfa049b7141b5dda2c237f3d855c3d65a8783c79772ec3f4004989efeb53ab2ee3006a326258fa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5455d5d84dbcfc5c0bc7639439a591f

SHA1
d66027d343f2848dc269e97d418ec51a826628e9

SHA256
c9eade294602dd715ca4494f786b24236f5872098fa0a68de0b46cbfd65c4d8a

SHA512
2cb7c933d5517301bec83fa7bb206f0ecf3be38c9f8635fcf522b67127615df60a2e4a07674ef5b3a7cab18330858250e2ea381ad5439bf8d80524adf03b841f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b737c42cd98daf07ba325818ea15dbae

SHA1
fbb14b19ca1b4d2d740621c03dbae85a9bf0ad62

SHA256
cb974a5d99e951234b6544f2dd5d9a38304d80a36672627e2015064b8a57a07d

SHA512
445beb52f506fd79d8e8c3b36899b56b29b7edb54e1dc180f9ff67d70f79f1ab23b0fd157099e9dd75395f47518a688729d8e5c5b9fe804971e99f9d1f4b4504

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b897a6c1ce5fc1f25bcdb674dc2d19db

SHA1
ba1399118b25d5ee0f634a29c5d66e5d12b7b5fc

SHA256
9091422f1cb0309f118c2c5a2cfdd253d70d2687b65c0202667a39ab38280dcd

SHA512
2d62bb802b0f6f6bb007687aeca719e9650afd03a4d24bc415d30e502f4d1158ae3df0428475d95600da2b455fecb14955bbca012e38d08e045a50fb5dfd1a78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
863b27edfa5b6be631a0a19794aebbb9

SHA1
1d8441e2b21a53bdd88d18c1e5a7bf2f926e2386

SHA256
cae94a6f5495cac12defa79def3d19a304fe399199e6fd21686993189ced05ad

SHA512
8185214d1b156934da8b8a5c4729918a78d5b0fd34157178095105831ec804fbaced4e15d5393d261a4fd7656716fc95bd3555bc98c34c45edc5ee982667eb8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
582e01bb7e22a41987056732bfeb0bb0

SHA1
e3bf9c54e6959674043e2b18c6419bb0e1d660e9

SHA256
bff22214ad29fb0d1e694132836b920f0d2385dd7f070f23a9175dc6b9cc83cd

SHA512
b8cbc62c30a85567f0e3d09b0c658bb1f028224566dbed05502cbb3a75807c76e349ddef93cd2bcc3623e19ea7c269c6e9b01d38e5545cd4ef23ad32c2cf682d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ea6601d1a36e27fd22f7745d1c5238c

SHA1
b7f5e6b7c487d6fd4b2876f7521b6f585e8da01d

SHA256
f58f2556bfa99e2cce034c6c4c95c36912a3f7b586e322e0cd7972531187dab4

SHA512
c02513ba7cda596f42db4cf1aba884fb211e1b92e345a27429074b872cb34a46b83714166458f7dad7e8787d206d207ebcebe5807cbe563ef7880361a63c36f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89c32726b4b56464046f3a238a414a29

SHA1
a1c116f429049c2a3531aa718053004234ecdb92

SHA256
d494671bce5157824b1bb908d770d8d7039872116845541c4b14e0c5d1aadd95

SHA512
de62bc96b00d40135c61152bd3229b5ff065c50ce40129f644140424c535bad49203631c40698008c9be64d49f36514d9e5d4ef2c4655ab451c1d4b8d81d4ac8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7319a1a6252bade16a88fedbb386db66

SHA1
8ac78af15448ed1b499cba9e831460d2a4611ef5

SHA256
7f7392a4d9401f45b4dabfd6ce8042751663c1fc53fa6985ec4290c61cd19f3c

SHA512
eda57c897f42936442f6f99df949d8fbe8822d751219cf9a7515b0e086b993374fd48429d5a35865e5bd560fe4b6e60e5a393df1d51505e6b7387a6e1bc113c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab279F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar282E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit