db7debebe4f35687f67326bb7154c1067c0b6623431b282f2b49ff873b9a3d3d

Analysis

max time kernel
134s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-01-2024 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68281ded24042162a1bd4e8fbfd9a9ad.html
Size

1KB
MD5

68281ded24042162a1bd4e8fbfd9a9ad
SHA1

dc5d4e79afef0bd9c6b786d098ef76f3a926cb2e
SHA256

db7debebe4f35687f67326bb7154c1067c0b6623431b282f2b49ff873b9a3d3d
SHA512

d0019e8c6c76d7fe87753682a9a6ee35b45549a756a4c75125329a5ce891e80d7468142b28c63e725631b6559c5593951c9618e05360291fc7b6469cb44c1a89

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411845350"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E76B0B51-B6EB-11EE-91A2-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000f5f4ad5a2aac520b0b87c5777e55e92c654d67afc65c0bc288e1aee30a205f73000000000e8000000002000020000000074d1a3c24b77522e2fd8d8b51f766da9ac1e99bb53752e390c43a2569a404869000000066c7b3e05732e306c034632145ad32c2edc5e32fbc71658fddd020607096096b414ad782406633f7750073b95e48c8107f2330bd299ae09d43273ab3e17869a2a3d0d9029537012010349e4784a227603d8429c1e5116ec2643c5a44e6c7395e253b770e3be1ac73d5f5d557d7322fc41d82692089f49904d3e1ec5824573f5a161d070b6669b54b2e13f364dcfbc27d40000000cf6baccdba1cd6fa9a0b90eed9e9038e6f7e8afbd977183cbd732745b4b9ca3d82965dc64967afba97c38241135c054ab4d617099a80d4cbcecf482b2bab12d2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000002ace86610c1413670f2b3b76799a88d6fefc4f518cd88a45329d073ec0795c30000000000e80000000020000200000002035cd0a4b141bf3f0116921db19a0675b013616388952ff46dae6668c714a86200000006c59c3bfd75c5a55dc4e19a3ebd0702848a019f372a9dbd3d600b8a10b004c9b40000000f622b0b70463da25998e6e22205cf8f0a513f327fd31e9574aa54aa357e548a6c1c91dd3586e1140110ba551049853b5ffbe8abdc68091ed2f88c16fda2977b8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10014fbcf84ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1140	iexplore.exe
1140	iexplore.exe
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2452	1140	iexplore.exe	28
PID 1140 wrote to memory of 2452	1140	iexplore.exe	28
PID 1140 wrote to memory of 2452	1140	iexplore.exe	28
PID 1140 wrote to memory of 2452	1140	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68281ded24042162a1bd4e8fbfd9a9ad.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c43e8db732e561ce6a2796c87402f9fd

SHA1
625562f877b3e4ee93dec6084399cd649310aebe

SHA256
b7ffdf46e1b0777cafa474be814b9dd9d8aa28447acdc0ab89d06bd5cfd75f2d

SHA512
5821e65b301f710fb121f5b3c86b94164a7808b05597fda2641d38241c2720d0cf49ffc31022640b2e894dc4bde924ef1d660ae6fa522eea29b84608803ae9de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00ac8b3c4817aee81f6ca09a021a6228

SHA1
ec07cc000a43aea1a10d30c9298bc7f11e100966

SHA256
e5272e987e92fb5d53e6fbceaa1bfe11fce31f721ef226fa5c49be99df0a0b0e

SHA512
8a6a8fcf9b4c8ebfccb57be150621b3caebe3ee20b327886995e566e5ece209908cc5ab146847797c369be6fe86f85781b5ac54fd3abc32c5a8d569b429e4c3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
056ec43ae6f0f12c57780512a012fe86

SHA1
9eb1e557d274de2ddad385a7c7237e233a798e9e

SHA256
722d2c1a14e71d0b889d1c77458f717dcf63bf3f815fa92446df679ad1ec3bb8

SHA512
79e4e2b5850586dc3adfebd68faf58a9aebb36908f22b1c51bad08df6d7a69cb4850086642890bc668857a6963afb5a621d1e6dee849967b2cf96aba7d8644d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbd746cf471ea2662fee5e1e457ee3ed

SHA1
cc40f792be8e44b39db79f443a8457a9a09b365b

SHA256
737c1a19b611d46c48b4dbf683ad8ae4f22da9de50a14cb6fabce7f5be411cbe

SHA512
cb0326d7a66ee30fdb94e551e2ec9d2ddad8979a3290a685fa650a9c9a1b953d501561197b5ad334dcf754c7a3c7255f9e577f49cd6c1d9ceacc2c677568a48b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5f822866b4d7e71604e61104d7de5cb

SHA1
3ef89830a04711589839c827a9658052d88055b2

SHA256
cbd8fb018f0961ca2e29fe4039ab04926cd3969080cf7645538b5c48db7a858b

SHA512
282eb39d9a35a3e421089016f25cb54f4d6f1983da75374aafaefdfa42b1bf0421117d590e2a5368230120ed7b9efdbd69fe3ee749c2ceace19ea974251baf1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1eb4b4c57b222f78c237ca2fe1f8793e

SHA1
76ad65d671ee0fdc477d192689fffb049a3db308

SHA256
08a28086cbc4cdc57b55e5eaa50de73ddc271e26e16550f81b6a277c87c784d5

SHA512
1223c864962299a94b2022ed76c0005ecb0af1ea9308f0713bb2b475b9a7704f392f1ee8cfd5cdd5c8ea8cedd941b5a182f626d2f3221bc062f64efe0f584884

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
243e1a3173399c61bef088787496917c

SHA1
79c0fd84c089977c21c15e1c9d72d88d11000b24

SHA256
530dcda5f1fe1d15af05027066d53886291266791e1ff1ff11dc9a816136a1ca

SHA512
a527c37cf2f5f7f64a002e654bb9063a34c8d8482695311b221bc3aa92e0d6a5f499c1d7c97f69584f5e68cc6fb4255417bc4487d005eb9f2fef4b261d6419a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29d47dfb152a4d1f579437137a2a930d

SHA1
974f1abe67934d34c35fe6cb89466a8225035250

SHA256
e05441928b1ddaf12a382a9f2e3399494171773ad4482965a8e701bedc7ed10f

SHA512
56b236a1e049a1013349ac1b2de716b163f4e3bafdbb3a69a5f2e279737772d437e7bd8ee20ecb912c59c55acd668d7beb7c01f82dca1c69fe8df69a2d3b3f82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3d170454ea28916e230ff8dce211477

SHA1
39c84886ac0ebe60ab8a88656a2bfb861f617cb6

SHA256
0c69d6ccd83a9a7af2278768e6ba2e2689217a6cb181fcd8f614ca45ae8417b2

SHA512
ba6483b18705aa1e88adf645f9f616286c992fc020654875fe561309dc493ff6e8a0c8b93d07aaae293cd3aa97f720682f50a0510964939be3cc30a2166fa904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a56f6ac27dbe46c3642f9083a27e2ea8

SHA1
db2238dcf9598e85d875f89456f230c0a96ce982

SHA256
73ff0be9571b4018abceb1d67f65661953be6af53fae7d6fef6d75192b65bcf3

SHA512
d06a5eecb99024db404fd7528ff45561c5dbdcd35886547689975356aa0889857a7cae3eac9a4bb0ec66ce1e39fd3074467647c962948bd5815a0bfb58d18384

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
158d999aa3b53c2a2964ce17bc14d950

SHA1
4a590e2aa641e6129e888c95ef14f6ec4c3ae1b4

SHA256
cea2e373222c4039c12d7b8b269c5f1c3a186a43c889d6d243cd7257e9d4141c

SHA512
6cce660696a10e619e6a4b09a86ec3d3dc2690cc6cf3eb7353a46d4f4fed8357d1d7fd40d056e0382c7f7d79a081e853ef71a7ce56a8f87560e7dd04c747dfd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69b578f37c622d3a7d02f8b15424d721

SHA1
c5f17a06e75a58710357cb9618b4cab7a3713884

SHA256
3f4180ec67081f359810853a76915fc2780a5dd825caa53ee43c922a6b8ca8f7

SHA512
8d4fe73c22c65ee01badebea96349ddf94ffc70b6b7fdc1bcd9a000d25878c390e0804b277b3340fd60ff7ee1f00178005d8e8e16300996edeb3835f3f6a2cf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c6fdf0968df0684e6c4377d1b1af2f9

SHA1
8d3b0b9434e0962eeb85ca667de7d73d37474838

SHA256
13f5053ca9c329ff5cd51d1e118e1e2a947f5cf096665872cece909f6a3b1c77

SHA512
3438454ea442d14cedc4c84a4b1376b613c903557df6b96c5ad6c604b4ad6b3b88c4b5d328ad21137fce2762420578f9112b86088e24efcd0b6b2f9bf495e410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59b576a1ca8d2bb3c3c5a6684a6185cb

SHA1
bd169e57e3d4a069abed24a980b4dceafdffabc6

SHA256
bfaed48331b1bd57ace0603c2d9a42f17c93dbb287ca7ef05a0d23a29aad5c55

SHA512
4862830b5538c37092382e2d32c823f3b88598fdf63d6dc7ee0da7403b8871247539bd0ebdbe1ca6c7de7dc990fd593919ffbdb0a1b28d7a575f09403a4a9baf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3e22af2af18e03c3a96b46378c22d22

SHA1
fe165596fd303c2cce854cff842227733fa70d4b

SHA256
4ee6b09b259ad9c20db3437e63d1f8e4ebf659925a768fca034e52825ce1d21e

SHA512
1dcbd9519065e1714d5d889fe57ded435492cc1f5ab1760fa92c6dff9a8461582688e4bcb15603130ec3721ba251e6dfcb2f5ce2c79494e7ee11e5895a31c153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77fe0a7530908f0e62700bc69b03bbe3

SHA1
21ae1bd2c76c2fa731eac5989b2b1008a2c5d408

SHA256
8e00c437e8ff2c0dd43348cf32a74b2f443cab90284727710be55ba2d354070c

SHA512
2e0224fd5c8050c4c9e9898c80db3825ef577c492dcb0ea91602239fe5a0748fdb1385795e8b7427719cc091b324c7d4e3b78b3234f317634f0c465b4d26ac56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99e5e67c20230865f47e89ba904c13e8

SHA1
18ebb78c1ff34e84558c5e8f9aaf43331d34c259

SHA256
7bccefbdd2c54155b141310c4e9f8f9ef18bacc6e35ba7badc420843154fed8f

SHA512
0aa0dbc0029cce87d1388af56f929ee570895565e5a675a1406addc52c2ad251225f29478e57170d76ff3a2b4b83ab5cef80943f6b5a5ec82a7034a4487d7e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4EDE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4FCC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit