88ceb3e0811dcdc49ca959aff210a6bb9a1ec545ebb64a9b21b76a27b975aab1

Analysis

max time kernel
135s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

645f5ae4f05827a1e425f7bb912ce2b4.html
Size

62KB
MD5

645f5ae4f05827a1e425f7bb912ce2b4
SHA1

2510682bcaf0590c3acf4bbbfc0b361c3e3e7cdc
SHA256

88ceb3e0811dcdc49ca959aff210a6bb9a1ec545ebb64a9b21b76a27b975aab1
SHA512

63c640125c146c2dc874848fa2f5722058f8acb43e6324102a57a7d35b62cf5f911309f134bbcdcc2d42448fe348faee48d526f6cc55912593fbf4afea31504d
SSDEEP

1536:M+xeeXaSLSNaEEnRNngE4lLaMMAURyIS/o1MKmgte2auhmbmvPtP6UFPhxgqgTgz:cA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000f3b11b4572efd22b83a9ceada600b3c0d26025ce2273d2e70a3453ceb8625984000000000e8000000002000020000000583c6a9aaf3f4e45cfd421f7b4ead04e90741ff79b5e61ece803df8dd446b179200000004941af02e2702e9b26c2a7962ec4325a5f733acb41ce08d83cce665f58a05789400000000f737703ec77b19c7388168e0a4bdf04420f918202e83f116dbc3251cdb68439880c2ddf1b1e72946f345f3009bfc56b35a7575ac5be109403a4d64ee0b8d823	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ca522dc049da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000004ee76020ebd42ca693c72e1f539255d63d21e467fb44296d0e46a879e450f5df000000000e8000000002000020000000a5809924e147217549aefe1de0fa919f556d876702ff84a921b2b26bcb17ad7d900000000b6c837e11fbe563143361ed7bb9aac392428a82d3e522804a5c155a31b71bafb2f55f8acace86974a524060f43f90f4521efc19c1ce4271e22bae4d0afb20fecb5fc49e769ba7409fff25787ecfc29ba5b39a7142a12668dbe28f90040e50b0a07594af57f538a4cefe12bec2357c6e6b48a71a5bb7e51d3f58a16fba33926ab03257ea2c50e50584a9222381621eff4000000020222e13c9e3810a5441aeccbb4f3ee22c76537d19b08c20e13aa11598b5257082304d3edbed6131d91482d057e64e0c8cf5aba398c20818ab6debd4061d70e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58539471-B5B3-11EE-A552-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411711106"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1872	iexplore.exe
1872	iexplore.exe
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2820	1872	iexplore.exe	28
PID 1872 wrote to memory of 2820	1872	iexplore.exe	28
PID 1872 wrote to memory of 2820	1872	iexplore.exe	28
PID 1872 wrote to memory of 2820	1872	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\645f5ae4f05827a1e425f7bb912ce2b4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1872 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68c041ee5cbb2aaaefcda4d51bd68095

SHA1
4add91873d47f8f902cb6892445365efd8af21e3

SHA256
50901827094e592363866a993661e32b2b9a607e1bd82e7a7afa3e296e2e6d89

SHA512
d1186730bb7bc603570b02dadd92a6b670756ef9b1082726ac04cc312d62027347e874d7219f621a12af07c240bd7d471d4120378cda584e4374a25d0c3ab135

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f45051ec80c5bdd643f6f2c47a3e4d7

SHA1
62df956668eaca8dc279272d908d1acfa1c40c07

SHA256
f212742ed4565642528c5f4188fe422d3b363de6541a91c098c59e9e89fd43b4

SHA512
5ec18077a8b9722c0d015b521ea2f4a1032bd64a56a0226b2aba35ebd1a03b13bc3e71cf02d317ca205420cb40e32f76b0485a7814475551c00ccd4b5baeaad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1128b0704a5e09b28ac4b5abbb945fb6

SHA1
3630e92bf4eab170b29b287edd7de7a312a6676a

SHA256
71d1176a8f124e7edd12e8b7035acd446ebbf778920947b2c4be7281539aa3f3

SHA512
fffe77bb83f2e07e635950af20fe40c2e7c2bbde13d99d873dbaf50ac2998bdd082538db6eff5bb5bef7db6b91f228fe694f3fff46713516475f1d0b98cabb2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce36db6329ee801c8c883e0a1854ccd9

SHA1
1af08cd28e55b3fe8e38274c1966931bc26c20ce

SHA256
9704002915767317c74e27b63e49a874d58e5f5ce7a6f84b1f398976eefa155b

SHA512
165890ed95f48d207798ab3cb3c118716995670e8d2af18fa161633f422e03890ec16f7112349db9d4f42f7bc669782545eace7cd088f15592f488c894337628

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9969b8dfe8283a8f754ee55b5cc6138

SHA1
90ee7f335c695ccec74380d2f641eebe8cdd6d1b

SHA256
780f28e216b9a5f1338cc0c6290d1ba4be37a9862e5d9fbaf3ea7f568a69ec5a

SHA512
d13a7246b967c99a2ffba61eb4b7c72a916b90f671e315702711984b3d813647713379d1d29b1dd1d8be4a50a2b1bed383290f92fa4661958ed0b9033f383256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ee4c5e552fcc11d93f8f284cf3276f0

SHA1
83a3b1a6589f060f1b02391296cdeb38497dd1fa

SHA256
58186c414c90f0dc2a5472cb1499b7b0d12caf32278ab51264db7f886e676b45

SHA512
ef56fcb09fb4e31bcc0f3e08924a163b22008398a7fc6415842d0c7d2c5dbb9d3c399264f5f8795e5a24403317fec6d43b92553b12d56d36ef97fecf19d9adf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
775f62cab4f870f3a5b375e0140652c8

SHA1
60ab2e2496f7de4d3fbe6f90fbfcc54d258bc895

SHA256
440c822bbb3e739b17e0c0ab949f0fe230ee46b73b4ed759fde90262a1885c03

SHA512
5997d8eac7e47bde2f4cc76b155e803d8a4b5f08c80c1c985ba2c2471fa846ab00c7790b2a747f0eabbabef9842cd4d2ea231ba9d191abe4ae16e3f01cb9f663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7734e2707e8c5aec752beeaade590491

SHA1
7450f00bf6edfc01d76e7e0a1cc69fb49bc1c7a9

SHA256
b4df1642d5d13b458b3e8f92ec665b38d639cf5d396b4c8c28c76c9ba9f2c060

SHA512
894fb86935e35bbca5ed62513fa6a2a5068492900e634f26c07505ee6264d6e6497a5e12ec49ab3c6279f05a40061db9877d943b08da70d11de2ffa9ab1efd1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5d72631c9d41c6e41b5cb09c3de312f

SHA1
edb87be2bfe0d7d01ca4bf76c642d207c874b321

SHA256
4d98768a53b4e141a68427fd1972949668bff5ee389f4d96f9007968ddb8e208

SHA512
ee19a0cdfe612ab7c0183b30cf8d85f18ab6bccde4b3398fb81df82bd9786a9c81eb926f35cd42189e156055a473b712dbe3e1a7773bbb73ca9e923d49eed3ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2608fbe13999a09fcd204050d7fbec72

SHA1
45c0bb5f487b192f4ce5237adb6a0c21997286dd

SHA256
f9fd9ef0720ff005a10652336ae9da9dcf9abc2d70c3bbf2517c7ac138f8a0fc

SHA512
fc97c718fc327cf103e43df950614370f80d342158b97fb1f7aa8d8c6664eef43d7ee3147da4659590767f438381d920002aca7f28efcac46a3bf8e78b7161c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbb7f570183f9b0631f01aee9a90e5a9

SHA1
cb1e72c9edb0fc8dfeaffb101e66bbb228c6e7a4

SHA256
7c855a737cb42a59259cee337bf47e076c42cac2caedaf92edd6403631b6e396

SHA512
415142e7c096e351ac0c82a4e16cb259b238762456d070debdaced7d20a114ff7cd7ccf5613b83318d7ad07c22a3059645e267c4d8c52af2dafc3a67af45e739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
349363d7405335f6e99d1b487633cc42

SHA1
e675d744da427f6b16d2369cf906d46539ebc949

SHA256
e72feddee101bdb99e16a575ae5979052e3eb4d0d4137a051c589904abbb31ed

SHA512
c1824d2d9b2b1e28002e1d04e20b0189c8671fe91d70d106175af71d8bfb8c697539ce962fde8d0e0fabac9981bfba005c1e92cc0e3f0bac6fdb327384f830a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7e126f2aba0b043811935072008deef

SHA1
a5866121afcda2c25d5e82ac5ac5acac09d1b862

SHA256
d3408374c06c4246da57ad11c463c91527b41a4329c5b78880e19b1c44608ba9

SHA512
fdbbf1d21ff1708e2572c77d4eaee25462e6362e3be5078892106d143f5965e3a9e6a0337f5437a8febdd5623436a72df5eebeca123987d7d5b67fb8ef21a27a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6110c6dfea9c587148374d7a8025efa3

SHA1
ee1b69cd8d9518e97b9309b8f61cbad5ddefcdfa

SHA256
927670ec383f62fdcaa64ff14f91f34df408de17175a8dee91d7a367cb0f2687

SHA512
7d4b1771bdad95ea129f00617501fb07896fcca4d18e2b633369bab4cd4ffdb322ed053e1a88d44f0d874732a481a55829b63e1fec31f75d4aa995c44ac86adf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab58FC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar599B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit