ebbaf38d09da23e91d3463cadc20b0390aa2d2686b6b7f3e1cc8cee7793553cd

Analysis

max time kernel
133s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 18:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

704b6f0da1d59df135e0caec6c2a65bd.html
Size

1KB
MD5

704b6f0da1d59df135e0caec6c2a65bd
SHA1

fc98dda4c290feffc096165ad14d14d723505b35
SHA256

ebbaf38d09da23e91d3463cadc20b0390aa2d2686b6b7f3e1cc8cee7793553cd
SHA512

9a34666cbd4f12196bad746795d9cce75c3e383e93c9d643f9753679a44541ded713260ac445f1c530093161abbd91fe8b48b59f4012a8e395337a7f1b8b451d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b7e3a52d4eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000091082c8bc04f49d0d424b94f18fdfcb85197be807ec2d8be92206a0c6772e60e000000000e8000000002000020000000317ffa1e2685aa0a8058febd12e488587da36425a8ea12e36fee798848dec43c20000000c939ec331233637fc94a1394afefb4c78695a2261131a1377be64e5cb4c421a040000000a256b3d844e3ecf69739829fa97086d8a11477b4bb861e6caf95d64f9f62d800cae3cc75e59446ba58a163d0a2e78dcb077b6b17f043ed01e3bb7e14f05f509c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412197882"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000027ad2c3dc13f1c8e51d3711c5c2d47ff17eca54ad938b3c33bbcfc6ecf6b2e87000000000e8000000002000020000000f023d890d36521dfc8008d6629979799c2451d49177e42df95e5027ad21783459000000027b954b93863d94d3140b57d4aee938543c77349ed927e19353257d6409d48a23072c2395b30180bb2cba7356b426935ae5f845fef6c95e46f0aa0127e9751121753b4c2b6baea1ea426553bcfa21409b091031b7ff8dc1e01ba0321da5a050cca36e81ea2c4541a65c364e41287f708d1d3fd6f7e48794c1b22918d239cffd7db63e8278b278fa4516f0125f356bc5b40000000a74ae793afe796383934c5039400a6aef2ca42ba64c009e3ceb05d9406fdc92f5439a1ffdc883aed0fd65f92a778a6025ab1e010a57033ab49f977899da4197a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4EBFB21-BA20-11EE-A29D-C2500A176F17} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2200	3012	iexplore.exe	28
PID 3012 wrote to memory of 2200	3012	iexplore.exe	28
PID 3012 wrote to memory of 2200	3012	iexplore.exe	28
PID 3012 wrote to memory of 2200	3012	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\704b6f0da1d59df135e0caec6c2a65bd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7e3e8c4f1369e2cc16c43c323044f22

SHA1
6a0ad303f0de7f16f1fdc60410e55840ea7f6384

SHA256
61b738ab539dc45ff766d1158cf82054d8aef214c645370032e8fa5ecaa66324

SHA512
48ffc6ea47550b57d246befe388163114186a76d00c2600565500606cb278ace508efa98a6970d69e45727709032df79fd111b24357f40b68453d052ce8e423f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
076a86ba7ef456acea90898742604fd1

SHA1
d03665fd4aea7299fe88c5fc46c8f9a0c77c9751

SHA256
90eb2e421ea8d7c6d5182f3464ea881bdbb52ba82e08bbcfe5beae5d79aa3c2b

SHA512
46dd2283e576787323737c1a9cedcc5e8571d018a6969631a785e55f72394ce8e67169e5251f1505919acbd4d9620ee69392b763ab2f113972ee87ec32eb0f59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b265cd64e4fe8ad7413b9fcee44c576e

SHA1
fac8db939ec1ed372a9bf9cb575a5555a28ae1e0

SHA256
6bff0e29c0f7369869e9a347b6e7cefd90f55343bd48ce2d5dc2bb853e359eec

SHA512
f97a3dc602e97f9110d36ea4cc288b05a7c82f9c6d2bdd556e7994ec7713375a2529e8fd0ce59eed915b2e7f9616be43f83e3e9d0c69306cb0d53c3c689e7b12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ace3e507c88d875754d0167a0440f936

SHA1
a6132549420fee30dbd6a696cc0f828896b137ba

SHA256
29122dea50724f123804c009745695ccbadcdb0fc367a0f6606d5981f2a17a0e

SHA512
4f4c6dbd728dc956da4f2c93a2ac88e589f684b2c7c7625f19dff181361ee83fc71ac21e80ef9bc394ad9a8d08dca59c6ba2627d9fbacd401e3e153c0e777df5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df660da3c5e4d412e860f7cc47da67bc

SHA1
1de8722a27361c6b5de862361f9abc871731b37c

SHA256
65a7fbdf1e729d87c3a469748ec57c3b5df03d3ed14ba47d37164b90d7acb4f3

SHA512
9c16fb5a97edfc5006547f1e2e4bc0ef4a89075d79e972c72e6698fabcfd0c45598dbc267d24c22e0643f3300243378b1a49bd76d4091fd5d31fc7a6d2609905

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1533a37a44ab4b8ff105ee721dfeecd4

SHA1
4858d16dbe09fdfb0a147e6e237b5e1635215fd1

SHA256
23425c8be7cae12ed1707c906a3bf95f518b7ccfb03d20054ec3a007da316617

SHA512
9bd06e5deddefbcfe790bc4701bb8f69b0b2639668c10515dfa6945011e1bc3f941bd5f3d5d178755b8ea3b13c2d46dcdf87d557bfed907e2bf3dcfa0e47094d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea74445600d6305bf5fe14cff2d445ee

SHA1
93a539e25f1a0003a845c2cf324c370763b855f3

SHA256
fd876d881931d6e0ccabe5c2fe048d2988bf370b26758c085b87ddfac6147cb4

SHA512
e8ff614b35406d572ffc764d4be0065f8943bd9bd6bd3ba3634476f4ecfb270162c03746be7049acbce7a5dcce30f9671d09f5697ebb45fbe9e45f543b593bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b194955fdb62190500483a88ce53c997

SHA1
35b44711cfc758ddbc9cdd4fe4d0956070a31319

SHA256
35fd6cf316ebadff0204328edaea900759ab14c757179ab745422f70f9b47d12

SHA512
282c5011e36b1cb5e4bd1a8c65bb464f399590d2e65a2af71e32af7e615114c294d934302b4370bb2eada97888a0797d86e23997183c65576f5e2147e2ea9497

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b3cb23aa0136d9c156927a359c14c41

SHA1
0b62310b4f6824dc87bffd8b6d4b7cb4bf844bc4

SHA256
64194bb9975431d1ce097abeebb26498821b509836749f458c4d4ffa81e5d8bf

SHA512
daf0adfe87f0b9c3eb779b310d5f8b8202ea87955da30fcca40628151469a5cb15c5c4fbf83b3982034fdcea9fb592e2f03423ffc3bf4921c2c73070979e0edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0edb6f414f10cb174e92eac62bfaad32

SHA1
31150f0bf51b88ab11f64a9183f641261f00932e

SHA256
d7b629ee13d1a0155897740d898f92e33dd72e03fa3a00f0047ec86165dae96e

SHA512
26a6411fb5dfb14d5f318c1a7691a41bebaab01360175b44427c32b8a7d151762bdbbb88ae9da11038a0dc922d1e0e85a1e3360b7d2114d2e81ea130f5e36ffb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab6ada1acdcd4b49d653aa12a15e196f

SHA1
bc4fe1ca4f4b66891799ee18c0bb83a32dbfe3bf

SHA256
f2eb10451e9982dfddcd2fbf766cc7294d667203787064291c60e13b47625859

SHA512
e3a6b74e82d439a68554743e6f79e765d050ce7437b04c3a100f2dd9e794881b5848021e961a53d7010d9e626ca2621ab6aa11166fa5e79da4bfce4c9c797a75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
616da62ee56aa1d95b63ad46e59a8a0c

SHA1
f758423ae8303b417de02ca76de0c290d831a020

SHA256
85062386ab285dfad52c32149e26b3fa84a2d24c74b758fda7948c1872a30be6

SHA512
f3aeb807e07283327ca64851766c7a4bdb0efda7ccbf89e17ce314eb590a9dd35c6f572c97afb4bf1663cb652e30e90a2455d1dc251d2220dd510d86c534f99f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
412ae5f191779b9899a619712f49073d

SHA1
0d556d59a6b2aed7306e4622a7e5afbd6e0446ac

SHA256
57b91be059934d374e5454b92343a19ce8b4542b19d354e95b0d98cf0eec051f

SHA512
bf01bb2e10b0b1728ecd4e010072320429c24df391c0dc93fb76c0773a7568c16c7890e148b25a880cfe47dbbb8263e13aa06c2bca46124bc4db1f2d872c22c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
261863c29b35da44bfd2053e60e1f8da

SHA1
f4eac9f9bd2cb92aacc94790f10e1be51567f28e

SHA256
60a6a203d993f8f478f650877194a9e91a1f7a85f61451b7b64e30bdbfa86e17

SHA512
1fd670a74a4e76dd9a7a232155e7795a9ab02e6b7ee6623198002233f728a5a0363d87290b25a42199d362ca6ebe0c1f46d587ee33fd0583985b4ed5314663ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1eb78c2cb1c8252d068000afef8f9502

SHA1
1e00b9cd826a956096146f34f182a77d591d0356

SHA256
04acbcbfed6215a921f551390dead03e58bfdd6dec6f6a90158e4c3cdc5968bd

SHA512
29036d614d85eebd31eab3369e16f3dc1249ae63c62e7f53871933f13ed02f3e6c5699239164958d7b39aa8863a26407245e9cf99f365dcb5266cf35df315552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffd69e23181539becb3f4a32540c07e5

SHA1
9cfbb54a68ff5a622c1ddb3c5574a992ec79099d

SHA256
216c82742231952c966fb1558c6f2efc227cdb670f0ee054fce8bce5550109ec

SHA512
012bdd5a95567c414d17a47cac0c606ac2d2072dcc27e0f0798ad9567f258c4c0c911ff1a09cb4306406bf1a37253baf67371ae268daedf17f25ac0b1e986eb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2657.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar26D8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit