88cee49656136ed3ccc178ab4cf56f8699360dc7a8d8b1555ac154b7b480afec

Analysis

max time kernel
118s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66145b4067899383ae01dec364818ffe.html
Size

4KB
MD5

66145b4067899383ae01dec364818ffe
SHA1

1247663a9d47f564dbe2594da003b14bf9aaa275
SHA256

88cee49656136ed3ccc178ab4cf56f8699360dc7a8d8b1555ac154b7b480afec
SHA512

c8eb863179af6c92d386732820d9067771b3233b0b4cc40d7a45a4631783dfc1ab44bea41fa4d6632405a24c918380c4aa461dd2080a87deb8e38392de6e6286
SSDEEP

96:rf9seakGiwLsvfpFFOxUE+vBUqsOeN0Eg9jag0MwU:rf9FaL7LQFIa9vBRlVEg9+g0MwU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000da72b114e4e8ded816f899f6b0267003d3ab7f1150c5f9c3691027919b25638f000000000e80000000020000200000003a4729bd847e5fb3bcc0f29cda6571b6d58bd61f46296e99aa878d0a1d580979200000007c016054b4307d681f74425719b6a191e9d491640b21c8badaa5370e38cfd05e40000000d07fc61dc9f4829813cba2766fba90670c0a8f4995cfbe009860458872c167d381271984af80ff01c2dd09f752e4e02491d9315b1d747ed5500b54fcde318027	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411775349"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBEDB221-B648-11EE-9843-4AE60EE50717} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000fc67161dd9251f120fea40af4f369b9cdacaa466441d240f399a9e0ec19a23dd000000000e800000000200002000000054b29bae9846f9ac4a3dd18e472f8d888da12d7581ab5b6d0114dd46eaee1ff590000000d3fcfb449c38ebb17f2e006eb1b72c1596c621a477f00c4829c5e540cf43d6234bdd3416bfff0c98a738c08dea66463c36ca0a89134016762ea47679375c52f0f3f70ed5152412f92fcead240a24fbdacca1d51ba5bed6b7bbcbeb0a652081b44f736cb42fab30d7c9cfc655986815895a34e749f1e01cf3e328cb0e975e66c335a61b59504fc22e879eb3cb596bfed8400000002e9085982a1f1ba577b12a606e0e92c62331ea77e62afb0d876512dd8430fe4a68f94f61a9a0411f74f83495521739665971428d66af9e461a14afd8d6b54a84	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200c05c1554ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2396	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2396	iexplore.exe
2396	iexplore.exe
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2820	2396	iexplore.exe	28
PID 2396 wrote to memory of 2820	2396	iexplore.exe	28
PID 2396 wrote to memory of 2820	2396	iexplore.exe	28
PID 2396 wrote to memory of 2820	2396	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\66145b4067899383ae01dec364818ffe.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2396 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b1dc0ced518bc0c53ecb37e0b54b927

SHA1
cdf4d076257b3d8ccc2d092d9f6871564228d3aa

SHA256
c4f17ab48831b089ff670f3b49ce55436ebd01c3349d9743c8943680cbef9554

SHA512
7ab63f002addfeba38f307eb93a21d82e18f85e92a8852edf4a30d25bf58fb8beed454adb4855a96f812e2bb17d95233a9ead12b7dade6a20fc7a5b0e25d8bd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
537ad00e44acfc36f779dc4936f9fc94

SHA1
173ccebd04882a4eaec1f2abc797d51b0aca64b0

SHA256
d3d633d48107b66c88a81386fde93aeb51c2481ecf8802319d4e94ea324a6804

SHA512
5cba4e3885fc05d6fa3918d79bdcd8641d72bb73739b2281c7a51138ddabaa02c7168669530b29f1572f800bf935817507a3125d2f17dac6730e3c02d56efa9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33e504759db1c1eb33708981ef76ec77

SHA1
a4802bcee9d110f913c62cd0e73afa1407590839

SHA256
f13edcc5c33cfab71665ed38b0c1beb7eda19bc9308da081e4b12e1cde0bc081

SHA512
72c6c71bba6b719cc1e41eeaecfc5c8ccd5e47ea7c824290f52db70d478bd024de906d06e1f29607f9dc05cbb0e3b8929703b283a198c7e5406384bad2f364aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96641a184d9e8eda7f53420f375be82b

SHA1
012e4bc552d0cc6f13e87f591ddbf93c60fade75

SHA256
9bd24ff5b0d360b65a60553d391252468d3477aee6cbaedc6e04537812f8c618

SHA512
c6ce5441fdefd7a9c7ec91e2204c871ab8a78f1bfc9c0a1ad1992ee1ad16a6c543665ef77a71c3b61ece84996aaf68a3da406e80923d82b08295db64a2caf9ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1280f4cfee6770416b838fb051dc0310

SHA1
3dea896bc2b84f91dd4fc48392d59f3215ee779f

SHA256
59a6672124db18a21dab2df2ef4c2902bb7e88816e5607cf6fa1cf7349c3662c

SHA512
dce2d32a2de7aad979a1a1f7e57e4676c1d3cdb4215ae446250f29e04791a88853a7a8a699bb7cc42525bb79548388ae7222b617d3363b6c334312461f420840

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69aeaa67ea4abeb9075240bc7d7496ab

SHA1
a864f0f782b1265c7ff6931f7d7fb68d1b95bdd3

SHA256
9ccc2a5ac1c4c938665b98ddb8cda4ec66924d8977f29e8b223f1fba7f0e018a

SHA512
1885ff97454df1151f49d11e3ce5ea5e645a126179c876da6df07424b870e6d9e3b52f57a929a2bd4a052cb6a79a7b56d9602f0eb41b6d54bc21fc50e4586d90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10c493bcd81aecaaa53944a945f9f0ee

SHA1
84479ada6ab3f2e9a9782555288724c32dceb2b6

SHA256
a6df4854b3ad519a82ea90764ff52dc7041914d950a83ccb5f234c45af11be29

SHA512
3c14b0d389ffa64e3c0ee93f46fe9f0f036a9a9c0fbfdab85ca4e172b16d26dc2d3ebb8d2cec2446ed596957427b3cd506ff2b65c7a37d9c1526364dd6bbb5af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ce84c5495bd25c3a43096254ede9118

SHA1
5e8ff4743a80bce7a19a558c4fe1e713a649a248

SHA256
f513b78a5966862988a105bc659778c6c36d8e92f4eba0e338b2cfb6ed8ad26d

SHA512
8e08972c63e36013502f0c14c57d055ce19f42dda00edb9f7b21651bd9eaf402a5cfde46ec5eebea53dde7d26adaab4f3f5fe78433a88045ff429e30ac108990

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb4dfd05521d85fcf658a68740af4b93

SHA1
4426ae4bfef798b0ade4842a9d6a9d960b36d9c7

SHA256
bd80597f82f2a21081245c1a7bd930b61944f3420f70781628e5a0e126db1188

SHA512
64355f977201c6f53865175e79b463b9451b10817f1852899d68467e94ab2fb0d7ba6810815b98d6d953de365a1335f74ef421642c3f44de6b5745b8fd3d04f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17c4a1abddd40c6a6e3205ec16e0a65c

SHA1
fc34bc564e9567f5c87e51b6d0373a3b3d212d86

SHA256
0c5de033178c362c0e7d8699ae4b624b22104c605487d38e4247ace6405904dc

SHA512
645f6dc1a3d355b45642936501563cb330ac7a9d21f84c037c3ae08ff96f7ab61a758d03a1a304fda7126075ac7413b6c04a413a39bcedd7261816c943642971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34e6a7257513d981a90f6f5de98a19e2

SHA1
154a05305024ca909021d47bedc562b752f7f5a0

SHA256
7c182c9f75082d04f8e3826246c05264138a839507d113651803a48079bfe755

SHA512
fa14499e5340fcb00dc4738be77050cf8e26a407ca7bc14d89c15160719d0c56952294a47208e166558e60b2a4330f40fb3928e5c07c9fc964107db259480b72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e8080edeba1d0c9392d145750189f63

SHA1
a467621991e6699a8e24939c675d16f6ab0ee489

SHA256
24cea6deed3ea27a25c6cd6bde724700500d99a87c222131f6f47f0ffb13f59d

SHA512
3515ad87acfeeb102f80121dc63745dca1021e6f35fa8d2d5adac3d5e4480c6e120ae9f1562f07e9cec47056e7951c3fa4ed41ad21007fbb0132f13e41d2fe32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b08de758b6adb23f47913ac512663ea

SHA1
d67f0a735eefdfbb63f55520152d3714692986e1

SHA256
56def159416b7e5f9f01b6e5fd77acc493e916393d859711fe2631d5293d83a6

SHA512
a7a1287eb29461340861a59ed7f440a7a7e33d0423e7da4809a911f93d667a20353eaaa4cb177b1c5294eea5aa4759aed8a691ff6b3f9b3316e4455a685ac77d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
251324857fc5401d114347d91241e8d0

SHA1
2d8b63af535a49ad2cb87534e79e99c66f0b9f1c

SHA256
1cb4b186a99c29f4c8000e5abfc2b95a38d8b709ae8745b0ea88859c81f473b5

SHA512
7a8c28a7cb82443d6320fa825ded7d98de21fcd7af285726209cc0a59683ea5ab68ac35aff14154e65d2d6044996da61e77da4492d362fceba79b5310c148b04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15b9a82805094c6173dbcc5f234dd98a

SHA1
3a8e48b71d80700a8caa2c60e6f82d5009405d74

SHA256
7c7dad440413937680e3bf4a2866d8da7ded453fd5026c179fe744fd78297d2a

SHA512
b0f588befb3f7be9e6891830f5065cf86dee6df04738aefac17bdcefabb37f857ed2463228f937d3dd426c9e9e1a235223bb4a30dc22e12a11574a054221e854

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab934B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9479.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit