c3e3d23de0d1045be6a80a253d9d445e772cab4b5955018fb02e79c289e1d6af

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 06:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64a8cce41379e8c45333ce5b74143c39.html
Size

1KB
MD5

64a8cce41379e8c45333ce5b74143c39
SHA1

d5313c0eed87a6b9a86119e824c7eb8eb7c1100c
SHA256

c3e3d23de0d1045be6a80a253d9d445e772cab4b5955018fb02e79c289e1d6af
SHA512

f75b545b8d6eb54b6560dd36dee7f4d4ee968a629471c561f296db122ad0f1f569d4de00ca707bbfbed912379020ce29a972be86d8fc4c0d402c424be171b8d1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4997E9E1-B5C7-11EE-9A90-DECE4B73D784} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000003af9c73e919c5320065e7e20d45f9c17cf16f387ec3a3204fb414f7873c35a00000000000e8000000002000020000000c2d8056db5d333dd6cde9d559b89e3d4e8ab1bfd1a7a586664420f30bb4ba1d3200000005e782210f7926db1c1a282523bf85eef3daa18320e926a9cd6b3cedf5bbb46604000000080687396d1626edfa667e1511732e7aa1b264be27b049494dfa6f1935b48e489c362577875131008df01fd01b5ed1bef10a41e5b9216c190001756f52406c2b7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ac111ed449da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000ac2db046e5a60e2d50d5d67b336ef1b55d598c6b23a3cabcc2d5af4e04980891000000000e8000000002000020000000643d3668b92a0ec22ccc96e19a3e7a212f43436188fd16903ed54bf368aac3e79000000002fbc35475d7cd21027b821184a7307fbebfe36e110b2a5dfb97e6a3ae926bcb5279d29db32d0ed687ebaeee44942e06fe58ee18ccea7070a3632f7eede78889702b177158ef174b6d8e568a44f8ac30140dd50963b81bfd42b13c5604203b6785d8d20b9fd7aa3e5fff2b801cde9888d40ea32a622378f947b01f603c330f92e82d00aac276eafa069c4140caadfea740000000f3af716ab26df19671b44849f2b6bb461421dd7ef3e72f253be7a45dadb22c97fb46261a77a765303f5413bb90b698f9132446b43b211e7e1feec69fed228b65	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411719671"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1268	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1268	iexplore.exe
1268	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2240	1268	iexplore.exe	28
PID 1268 wrote to memory of 2240	1268	iexplore.exe	28
PID 1268 wrote to memory of 2240	1268	iexplore.exe	28
PID 1268 wrote to memory of 2240	1268	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64a8cce41379e8c45333ce5b74143c39.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1268 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe7c73a9844679dee007122158b0de72

SHA1
993ac80eda1c2ca2b916b28d4600becb206839f4

SHA256
fa949dcc984e878d362ac99bb50feb81f899abe2cf2d8d7a24cc6a7aad5f6108

SHA512
3d7f8390aaa17359d91889da0a9d08d51c2e5420b82b56bd7e6d7d8fc4d2dd13b36412ec9ffdd6a45879bcf4d1c023e9b57269564785d8341f18da8044f07c3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c2a235be1927f77aed94f2f3e00554b

SHA1
0d42085d5c5d4c991550ad25c88a3398da8ae9cb

SHA256
20cd97f89a020b47c1c710653e4fbbb9bbb27f5806bb202cce3d73324608b67a

SHA512
b5600eb8a0e274da09ad3e385ad85e8f7117938f1f312f54f0c6d593c372aeecd01290119df3bed445d792e9d9b0e076910043b4c125a25409a1e0315bfefbce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b67fac7617fabe2c8eaf2991e678a42

SHA1
a352c9011e57bb502ceb2fcab4e7f436730e2954

SHA256
8a2a3fd632ae2f16ce09e22d5dde38486a21d9fb41f772dabc0351dfb42f1f4f

SHA512
c49ab0de4364057bc6cbe48881e37409a92b6b6223ea019150791c2d74858f4f51ab607014db136134ab4dbecb4e5c005b88617e4a2b859f0a6fa685a09b38aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
767de2f51c93fbc66c4af425b065186a

SHA1
9ca574673adfe00439a304ca4b59f219f4022500

SHA256
f50139e53c844787de38231bb01e6f7b9fdf4167f99d35c711b19d50e0f3e916

SHA512
d8db385108a3ab659dc47b86caa9c3d4814b5a2313f4a5f998dd670fb1950628c4985bc1409f40f2ad4730f5f390ed4cc9e99115d86fb50294252c814599d5be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf1ec6e7714c0e906fd32a0fec6ed6cd

SHA1
daae786d49ce01bd459f9a02ec968cd2d4003539

SHA256
c4ad0fdfe7d1b4dfbeba84e37ee94fedd9bbef04cfd8413c750c10d891c8066f

SHA512
45d7ca0e0cbc303b4e66f3730690ae5038d4d09a9dd2f4bdf0493605f0eb047f5afa60578797fc48741e6a04ff16604b36611ff188a12e7eeea980ec5f6e6643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fffcb6430a2d94fd0bb471ebfaa22772

SHA1
646f36570d5ba6d8e0069a07c23993c42aaccd36

SHA256
4569d7139ac33c21a0ac11c96766ad39fbeb40c818bd1b1f5d25810bf442746d

SHA512
0bd39b3a672723281cee231dd70e6b42497096ed6a84ea7ba2b4edfd45985db374858fde50c727aa53e8928b6efeba8a0d6b1097d04285214b1f3251e47d9afd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18763226ce4f1b7a81404cc200d1169a

SHA1
f720d7720b8d0031286281e92a1f6f23316ed785

SHA256
483a496dabbfae47e6d1624d9d56853d20d4b7cc2615b2fa340733c4ecc061f5

SHA512
5ac6943ae6cd560809d3522443d9006a1f243ced2e76eb3e7763823a7021dc1bc83bfcac9adda570c2175837b18334e7958637304b637b492cd33672b8717d84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9da056fa09822202d24a1334f717dc1

SHA1
b1aa1bbd6104aa52e6b4ca32c602cfce2cf55da8

SHA256
c5b15ed45b05cd294f40584976ebf3912d1a307c3dfbccc0a26ea787a0676ebb

SHA512
6007baddfbddc9a6649cd6ca8fbf986358ccbc0f52a1a506e59fe76b179ad6bb9ee29238d13be477e622e6f2647c40300c961db6a9bfc52c9cfc83971bdb1301

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
286ccfe2ef4f4c08678a45ad3e72c9fa

SHA1
4e5163f6b5db78cac84a33f3070d0ec0a31d830d

SHA256
707db9d43941334c3566cc83ed13f70ffd7e02cd80258ae519592e17d65b40aa

SHA512
1b76c0418e1004d940163647d9b765b296b30d5d74e164455ea04213f3ced35a14343aaf4cf2aab8698d8554bb712c9a19cb2f59008561107bc80344a0c17ba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f72536a02d05a050ec18a8ee0cd8059b

SHA1
3de61be1f2dd2b1e85fdcc6fdd2cc9d44987b951

SHA256
a242b944d7c18a0ada625b63df636645dc2de26b652c471b58490014ca1331fd

SHA512
4a360cd47a2cbbe19b51450944597002d66ab8222e4160bc8af3fb9d3caa96ced53ef375da5ed10a726f6fcfe0d3a2aff920a23b745d76206b75069304516013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3707d8dc0a0c1ba2119d8dd213d519b0

SHA1
f561dfc0027728be2347d4fb4f9e096183b66106

SHA256
65ed48780ab3962549df0622d3ad83cc8413e3cc123260d897ae679c7c92045d

SHA512
db37d089f513f54138b35b8c5701d1fcbc89858a563c8f77ddb73a47943cf111fa43cfd4f58a5942d8306cc5614f40fff44e4aa66fd3f2c605698a7886611324

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4285bfa6d248ad63a9cf485626331294

SHA1
dd8a6bddcf3a59e80d6c36f4b23414c382731468

SHA256
a1d90d08eaa7d0888ca408335107fdf3886f0636097a0b0dd353278db9dcabd1

SHA512
eed87b5f7c7f4fe91816ff2d46bfba7e57802f1582f53e7b154922b3a8743cc8586b84c7c7ab7e35ca0366e67d145c6316aa3d4d40b683436e160c75c9cf11c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfb21442bdf47572f782ddc10b6fc287

SHA1
8a85f9a12201699068f5fe2b8eaa526135aac715

SHA256
a18e2c0967571d9964411199aa329daeefabf8f6d0ef004d7c70c430eb20fb39

SHA512
8869038d7d09c22436448be012ebf28db8094c82272596827d96307e4fc7b9240e1cf36d1c734de2bfffe059503ba9059e97698453fbaba6f0f86106646bfd08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcf806968330867069d58ae9abc6cd2e

SHA1
dbadc4736fea1949b8f170816c34338810232d84

SHA256
2894d4fe5d300c4923c9af2c1db64db06cd92b69d7f33f0c19634cfb9dd06c14

SHA512
68fd9cd00cc6ac9a760ba769c7964fcd85902689f6188b7eab43e3fbb3d33042ed4463e197ca23f30a55ea55918f21cebc7aadc8cc67a36cb6a71a44e7252121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
140a0b7a57ddffa26eb2b50c25c3fd9e

SHA1
f9e4783a3240586c76ae81061d7b8fffab6ea111

SHA256
e31422e615b1339d5fb9c0de8d0bbfda3282f1540bd599b7f886feafe0d24bcf

SHA512
c6065d82a318cd644bb941b14b57dfb8052165c5a4e33049e12e6cc6f59159cae6eeb1899f6529bfe10c9522fb96f4b7f8fed422c11607b3789428ee659f2883

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79b5e793f189e377d8bb25ad5803c4b2

SHA1
2cd310269030660e9c89f445311cce455f54f5ee

SHA256
af8d52f56aeb9612e65116807b419443b750ee3665391a07031ff4918b2306ba

SHA512
781abfcfe3ab14463d1bbe557f92bc084cadeff6010685ab422c0abfb9c0c85dea2d5abf2d7d67dbb257a1ae367b741016f44edcccf9d67d7d2d5114b134732a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89761d750c8b57ccea5f72d90fbee6ac

SHA1
57ae664c1f58b88b14c6f651859a03c576ab387a

SHA256
b8b87259baf032a5a5999c7b3840243b9043a4421486c4b8eb179c0990163b8e

SHA512
43d253eab1e99d563ea54d235f7f008c33b646f4cb30cad7667ebc8156cfbdcc6776b9d8906266a2cf9c67fbde3d434546edd9d457161bed77bccc8047c7d081

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab341E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar34BD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit