86452b3c40c75e112a2aea0a6980b15f47f7eff1ebe2a33af653a837725f4d4b

Analysis

max time kernel
134s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65cdce765dd7defce4b5a2a0240671b8.html
Size

104KB
MD5

65cdce765dd7defce4b5a2a0240671b8
SHA1

959bde0c0058f2df4d205d3d92ace0571b6d33a7
SHA256

86452b3c40c75e112a2aea0a6980b15f47f7eff1ebe2a33af653a837725f4d4b
SHA512

5e8f8e16429a11c4d4b52725a46ec2e1400d236fcd40198899de808472c89c572fe281bd9dfb878d198097525e8d4ab6b430cf7229bf55124a292b1d905646b3
SSDEEP

768:qBpPPLKoPlF/eDYPbx7HG4a/m9SxeH9Ww09LVMrAvl3vNNHOolaywHBIbW57TqLW:r4YEdL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A386C851-B634-11EE-A586-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9057956b414ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000006c6ed7d3eb8555bf7602d3b4449e4b8c970342925403d082c0b4585d8f971ccf000000000e80000000020000200000006f3640a23c3aa7656982d4c290084a5ec1e0e2279800827710ac5b0043f6f98f90000000589fa23b422e5c56f5fcbed16424c79416183a51959ceb566ea937fbae6d60acc79fdb87c6cbe65fa3ff9a69e6a928defce7966573a542805488b95a1dad545f547b3d832b9776c73f394e8f876540006786500437dbc296f94749d006e80b8764a33b6867ba400dda75a3c0fbe9cae95e6b6826019bbe73391ad9159c19152b0a38379d79618ebc1067494c69daa57d40000000c4d6e488a5bcacd89fa3332502c12aff0c0fb80083f793166f37538e0d4e59f1757a5ab4dbac9d6811c54205247aa73f940e41b668f69d753f306c07b84512f3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000076d504c114a0aad7d38eae70059223625edfd7a697e6372393be5eee4486fba4000000000e800000000200002000000012636457c47f72eb8e953cb07772e8f0b8dd01f6101cbed50f359af93ed1524c20000000d057af1626a47cba35669abf54b3cbb4ce1f4b7abf121edf8e28ad1bbd3dd16b40000000af9065337636c3cf32680794adb0ab80db7763eb092f648fe6831666f0a4c99562f4ee9f65aebeb9b13e556f343db129f4fa052350799bc3d106edbdcb16dd94	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411766637"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2264	iexplore.exe
2264	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2304	2264	iexplore.exe	28
PID 2264 wrote to memory of 2304	2264	iexplore.exe	28
PID 2264 wrote to memory of 2304	2264	iexplore.exe	28
PID 2264 wrote to memory of 2304	2264	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65cdce765dd7defce4b5a2a0240671b8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
888edb521b3e0f0c7f9717a308d08dde

SHA1
23b4529490824cd875566bb0b3ac1bd728c8b4cf

SHA256
6c9b1552a848db9688ec5715e22b05f0e4ff76ca1c4f346db9df4fb3d2f3796f

SHA512
5aa2d574261a9af599f3b9278905091530078c979184c5042234622ed3c6a8b9a9276837a99d68296589de8b14a02156d65a989b981ef5cf2710bca5ac6e2f49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcd4a26c20724ab1d8ed8b773c8b1759

SHA1
61cd0c1f1f7551234eadbbf9671b33b030aa6b2f

SHA256
523316e8027de7fa0be40d1d5d370ff9265585ae9f3dc2b2277a05fb4fce9ac5

SHA512
3694e04dd7171f3cb4eeca78cb5902604dbcf65de636ca8cd8f34f29a8e4390f9d2527f6f9931be02c835f0c37b6fa2cba8a30069fda92dc91812bbb45b04ba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e461e2c2f08113e37a58d7ff7b2f047

SHA1
8f97bbd500b3dc3517f87c69bf96a13c6e310549

SHA256
f46ef6e31fc1b50419a073fc5a7c30038cebbd95de7c40419ffe1f4744abb59b

SHA512
1e19320800845be381100dd8ab24280907dea9669ac285c0b3d19d12f822496c9aa144ed5b19ec04cb6ab85647ed12802efeaf1af969cb634f2e60a9cbdb896f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ec9f412961f500a9996cdfad4dbc682

SHA1
57dca403a92e28ddda882f841ce46884ecba0883

SHA256
b4e952d6d0fa868dccb73e422ba74fad9d0507e1e813669af502046030aacb3c

SHA512
f64a69bacc96e3976ce963be8240013091de576a7127dbe5a132e6ac65f07dcfa8b892ca5bc509d4c47667cc01f2be6734ff27cf083819092f03f2c8c35feb85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f1b63ee1f84e45283598bc5f2e01fc1

SHA1
6759837e63082e392a9114773da6007d74822d98

SHA256
b28e541f6a620540d6c5cea21da7fc82c09c7466cfb39f9ad46b294fb2000db5

SHA512
38a04cd6989a93bf75b065490cdfa7ebf07452d70dcf4d3b57be6db5efc235eea63ed9ac5ffa7591f40079bd7e5a2fcfa2a9b2c4bdc38320325eefcadc26fbff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13e0867b9770980388f0d9853efe2e78

SHA1
ee12a224ed88baa38e773f8207d82db2b8ebaa24

SHA256
ff6a9500a0cc815d9fda7d28f24e8cbfd6ff853bbccc5f084fdce2c533f90b3d

SHA512
78b4f212c2d3dfc0faccb96fa75b25703044a670e676f8a51aa2bcae0d2134c51cd37e8ff1e0316aeab82e602f35be828aa931a59cb3c332c14c2e1a3fb09f7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b52d0a754af7adf6928af8aeadf6e4d7

SHA1
9767b52364d579993b22e3b5e5b87f90133a0e9c

SHA256
62900791e5620484e35bbd16e0b00ef3a89368c6a95c19e867eb435aa53e2396

SHA512
78d1346a7713cb7e95043c93021c923e6c74eb3e132f52924be25d8e728e78de595adf2315aa150619a244ad9b89a232c529648703e0befe57e93f16eaea342c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e53affb4da52b036dea811ea00b5c47

SHA1
e567e0adf5e574e9e54a1cda0da4b5a5e7fafe35

SHA256
1b93eea190165c67fadbc60213f13ecd8781c8e3860fdd71192cb4dc461f91a0

SHA512
a7e85b3182134acb8e2780d2d35e80f5a8684b5b6513b36ee1d3aaec5e134085c289db1b2b197b8e00cf8fbee103375782a85d6368a9936d55467266d78edf52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6956ee7429932ecf924ac13e38761276

SHA1
275431d21020f5c40265d5c48ff28380a3e9ec18

SHA256
83e514b82e602196a41ba83fa1e55e7498eb63e2529e1de6b82c46bca210dc42

SHA512
23de8a4f7a526d29e42e5999504be10d18162e55f09a33634cfb90e2fd12387ca67cc06bfa8ecc45656e76204f342ec7a989d833225a22655b7f2a9095c9f86d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a309418383cd863071eda22316cbc606

SHA1
9ce56e9edc8852c3fcfebdf3d340936e2945271f

SHA256
518c910813f92be503d67c5caa23af4716c7b895f45ec7b7d807ac7d7eaab204

SHA512
ca40172fb5a262b36172e4bb9d6ef2edf8b052fc1466758ab19704d57d751141796ee31f311706581dc0b0d3f984ac7501f2e1099f0102ca2af55d95bc109bf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b926d7bdbacde7e925c80df08aaabf2e

SHA1
d3e8b6acaf50b453f0e31f673ead5bfc0d91188d

SHA256
21d8673c8e9740bc18566b9c8a9cdb7ecb8e1937c3fb9cb4a865618b7606e5c4

SHA512
425460929ad3ac68010dbd8a83c2ebd211e2f1e60ebfea15dd0d2cbafcbf5940a96ebdee4ecf6b38d98fe2dceed4b0462ee7a019dbe990e0e1d6adbd1c35bfed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1062095eb75d167b5365b5fc546d5123

SHA1
5de7d6dfdceeeb10da8f1820bccff03e4c80706f

SHA256
8628f9c4e093c4af6879ddcfb232f31e9327f6664828188f3e92f42102d5a150

SHA512
8ad9991f6e933d35a9ab7e0f83ab595c889757447b116902608a3c389152ea4ca6eb6729f2a26296d7adc8acc933affa9ada6aeba35c0d4dda5df7dadd7e27da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
250c2d645f57bc6df8fb6a5b3feedcd2

SHA1
e518a7d1314319885adcf02a8e25b456f5f84308

SHA256
08614574c9af76490d622dfb6119967fb276d16ea86915215c7f8dc169ffa02c

SHA512
7b9fb4b35d2b0b86174c48d68c35df77103478626be02e81327b3a0bb9d1908f98dd8c7723b4257642dc910c64b7cf869c0fade9875f9dee4ea2f3fdc5b5f925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82d3b2ff0fed16c35600e56eb807f2be

SHA1
cd901bc0367d9b80c2c0fd11408024de8e72ceb1

SHA256
9564561587f08fd1bf38f38c74443a2a8bd76a38ae2b95db979ac13dbb674295

SHA512
d1274c23f508dead5aca26571bba04bda56720956899bcff1deb2d64a3452d6924e29c6db39155f8ef6e769c38f51f7b6c44cffb82c20feb3db051779e97e882

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A64.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3AF4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit