d582e886580a8b2ba70da5488c8dc4bc9a1d7d3f2dfebdac05525999a42cc3f6

Analysis

max time kernel
136s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-01-2024 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67d01e607924f16e5219ac2dd7c86a5e.html
Size

4KB
MD5

67d01e607924f16e5219ac2dd7c86a5e
SHA1

f2e9a242152b0ed14435e704f3ad9d2b095f8f04
SHA256

d582e886580a8b2ba70da5488c8dc4bc9a1d7d3f2dfebdac05525999a42cc3f6
SHA512

c0373767a15cdbe580507240dd321a61da3f0c5d2baac4ed68ce966b3c0c7c199d76f0e5d08f15ff7f8a64b303cb28e87a38833e9c99aa25ae4299ca463533d4
SSDEEP

96:rf9seakGiwLsvfpFFOxUElKvBUqsOeN0Eg9jag0MwU:rf9FaL7LQFIaUKvBRlVEg9+g0MwU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a6e1fbe04ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{260F6851-B6D4-11EE-BF8F-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411835148"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000006cf12fd1aa0524d6ae5262e2624226ebfbeb0d80445ee3bcc4809836cb9978ad000000000e8000000002000020000000a3181f97c56b9e555b61ecc071352fedef206fff81980af16caf8846d887629720000000c6686225838221de38d5663e11221a683d4790478e0bda7fff163943165a2c394000000069a763e5e9623f86951327e6824a58c5cab8ded3906bc0b8ad89780462ebebad01491a4639178fe819ace5750dc8dfca2d0138f6b24bb4b17026632a381687fb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001dba31c6baacbac9be026087498e492c4eb7cbea3bfc9809aee1494db8c4b3a7000000000e80000000020000200000009f2b4753770a516ff94cb2d896fbb6245a6091635fd2b05a2d9340754f9c86139000000030d989cab8b1cbb9e03c3c230affd1b35e7afbf3255e5ec4cb9ab51d06a5eb7d8b47ec81ded7a65b8b0467c609b8a6e70efd4c938ac42b685a1bcc1226afe5dcb1e884be06943bb9cf86ca10bcf249f38438b8f6bbcaad95ceac815d35e399cac482c3dbd2ca6062e9bb84b3f1f4aaf8697269f88c3fde3e7a525346e41b602fc2af57569d6eef6c1a759e80b9fc637b4000000074c6f21711d1b81b29976197d39127e9a13815ed8063572eeaed4bf1fb57cf51f1e9a6e4f369abdfc9e82deea6579d6fcce3598fabc259886f36048656ee7203	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1204	iexplore.exe
1204	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2912	1204	iexplore.exe	28
PID 1204 wrote to memory of 2912	1204	iexplore.exe	28
PID 1204 wrote to memory of 2912	1204	iexplore.exe	28
PID 1204 wrote to memory of 2912	1204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67d01e607924f16e5219ac2dd7c86a5e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2af6fb2ff78b816582c82a49b0df6f16

SHA1
18c8f0caf3998f44bbd8a77ba6708172842ebf18

SHA256
e4c658761c522c5f11b84a39eb6a07b6223aeee7f5acf8b89b4aeaf600775f19

SHA512
f09bdc4dc574fc90ff900912be0ea430b4b6dad2c08421fb7b9693596b42d2a4b3411a01e3b7acc3521cc96b83d55b31dc08f6e56b89f575842dc5678ab090fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2461335182b6e7006334a81106c383c2

SHA1
5aa31e61013ed965c73c5e283d822c24f29f9cd5

SHA256
ac8f2f0041266810657c1849c34dcffd303cfb02815b2b3c808bd087412b85e0

SHA512
de11ff4dfac3baeaa793b8e99f4d20f1df8c34a46310cb6fd80bab287d7511d25cb3ac6db04b5a834a99085f70655042a71a81fe610b5394eb5d1e25395ad7b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bb4bdba0cc77eec4ef95135b23c292c

SHA1
465399f767fca24a89445355ef74473fbef4f3f3

SHA256
d877b535b1c394b2c6828d60fe53f9eb5069c754435fb73a7ce8487e5c4fa5d2

SHA512
ac111a4e9449f12d5f3c2ac57b296ca006699af8abb6fd850aa353fc15121e25e0f868ae0a0460fa0cb02caf22d8e7c41e6f1e354614b1171e64f916ff948e9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32d167226fa93bd4712fe4399b3be161

SHA1
151cff9fdd68398c1a4a6432e8300310e2437ba8

SHA256
b8d7f2c637f138e4b5f488ff65fdb0939b44ec4af26c49ecf297838448715349

SHA512
bff2e57f1d8e8846317adfef683121e9d05c6655c5d8e5c49adf0e108f25a85c9984cf968e76f00c80b41775490596bd54e967f8f9a0eaae4691c72dededdeb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
648b9782c9c4ee84a4c17c27c4a8f589

SHA1
7fa6d77c8241ad0056a036e56a05602cf6baaebc

SHA256
723c71b8a45485286d0814c79247c9acc4cf06a289422615823945f9f757cdc4

SHA512
aa7a37ac95508d03af931438fdc88f21dbc75d920f8a7ab18e39d0cc02a49d097535b8986f973a744418f252bcdd52c9318a8e63525c909203b201eb42166612

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e87ad4c3bc707a86ad3a25270b468683

SHA1
a0e48f3cc43df7bf58fc92e37793ea8074406456

SHA256
72e1e113eb96c460bee5aaa30a98795d875aaac5dd40078c9c9c5618be1bfcad

SHA512
d4dbc887511ab3b7edd6ee19f64553799eac44fb05f7c9d0b166a542fb8b93a91859b01a9b52d3b28a6d7293ee9f8d3fc77237b9c0ff386cf37f0af4f5bf4718

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
184457420a005a7417f4e436d1aab314

SHA1
b699debb5da05bb964a4de5ac299145d8193902e

SHA256
883aa701071db9e986e3129950bee666b1268470c6fe567eb0219c076cfda29d

SHA512
125c09879932f99d9899f9953ec0a42b1d6fcc383ee9d6c3349d59c187772eaef0b79af43c6008ad01bafb33f79f2bfe500eaca9e4b7fdd959a77f4e340459ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1d2cfea5789cbfde21ed94bf2aec678

SHA1
1350458cf1b7e8affbe80d0cdb11a9e776f7dbc8

SHA256
0701f4fc3aaca0fadb8ef2eac0df4d533c4c54fb036d9246a27e4d7dd5d82cbe

SHA512
e68415ec32260c630ec916127848be584af3bd5b35d4b9b5e39a02576abb7f4ec24d190eb4471297eadc3ad6787aa719d8e1c6badbb0323c250703a7e1dc3105

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc9a8bf8e26a4f68c0479b082af4b68c

SHA1
b427b17d6e757c96f60c7a30ae975a89a537f54f

SHA256
ff15793395d5acfdbf6cd453b963aaac6cc206bf27b08ea88dfb34434bf9f50e

SHA512
e6e99365edefe41c09ef3178b28e8ed85949f0f1163623622077daa1ca1106aa1dd2ee3024ff86ec24f2a2b7ed260de2f7d1fa006e4e2e24c25281c930c5a274

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f7f0171f06e51c4f0bc28456a5c65f9

SHA1
9b35885e1724bb90097570f56ba20460120ceafc

SHA256
3a78cd35f7c15ede3d753dc19720c779d159a3d5bf330f4034a424d7c93d799e

SHA512
594b12a9c32269e087697c3d07fa54a2a5aa7692e2a58074366a4791ba825363b05b36372d9c45379dfe3387e2b69a85f8865f6037c9d1b783f5f80efc1310c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e872ec040ea24010f7e4ea1e04cfc24

SHA1
b0868c6b9ebf3b6bc8f69d1bfa1d12ce044fe06e

SHA256
d2c9f72078759618ec69ab87a70989336e10933d4f630a1c762be605f1dd7422

SHA512
6e06109432872e12cc55283e16e502203dacb4c77cb181ed4155d0f494c04a1b42869b3068ab99020a98e2af35fea505093f5fbfad6490cc2f09b65eac2e4124

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd93139ea741215e742a8cc19384d71b

SHA1
8bee1f6d85c15fc601cea10e6b4dfc7b0d3ce3ff

SHA256
943924878496958fee6ff87cd73bee2dd05f8215023d5d1412a5984062f9daca

SHA512
245dfebeed4384ae265a9685eb6585a45078ddcaeb78cd37660e7befc47e9841ae56d4d3133aad51d4f609dab27982f0cd20a37914a700387552af3a80a45950

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86c28d28a70c5f12d24f17b65a9a087a

SHA1
07089d76bbfd82744ea33d8e5c8e719e2f988123

SHA256
03324ea07f591df9154286ce3cb49e1db0f7b671e4f51c1edb7e0bd5cadc8878

SHA512
1df8a32804f43c521f55457b6164229461a18664a1a11263ba3629c0f5d04d3d8f0941cc6b0408b81ae5025a913c540873841ba02a697450b117f85a07b8cbc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7c9860a4dc3cc5f218b8f56c4c9e077

SHA1
1c93ebcd05825083b142dc85109c30ac82cbaf9b

SHA256
ed33078ea8a31e1bf19782ed4e5ef8f8bd6616927928000080bb07d3bbcab372

SHA512
87e1388a0273367ed121c4e31c7be3433337fcdb7687068537c13995ba2fec3478df56ec5b1200bfa4bacd5ee554a754c249062f4213dee0e2fdf590d8051923

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c71827f5f7464ee7cf1ffca715fbc6e

SHA1
d5ee4f7c6af6ba1d869d6a4a7ce6b90462736078

SHA256
e284d998b22b687550c83e1a5c53ecb8edbb1be6cf7b77605a11c3f619192ad5

SHA512
fe57ca0fb65f1041e77f63e8b7214bace00fc7d69c249b55fe4549591c6ecb19f909c8d1d81878ba2c3c64ac829db82e34926178a3d22ce71596b32e454b51a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bed387aaa18dc1183055f68bb406bfc1

SHA1
25146b77748bdec7bfe4f97b8eef461a30675806

SHA256
313d86b85f699763b1c4cf0b4a0d5f98503cc52266de8b2b398fbec0c6ba6bbd

SHA512
3e35896055a0db2e2f07abe6a164e6c37e4c975b8b2f8cdb2e08ae261fb5a04bb9c52df6f22ceb0739f15710756b0f1fd856a1416fc6a24a41dff535bf35ad71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efce77c6507950bc7377ee398ee2371e

SHA1
06195246ea924b838ff86326dc2f4310574192fc

SHA256
349bb0bb37c34a9a19a43cda0ae3d3f61f6a9158c0c64b55e24e7542f28c9671

SHA512
10897f6b86c7ce43c93f662ef447969a49a6f434efd8aa409b96da8c6a811de59f6d10ef054261f25da32bbabbecda2d6564e3e8397ff0f3997968ee31f2a3bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab89BC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8AE9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit