da7243524c496e84d41e1416733ae66be8c09e063307b1f204298f49af9bb468

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7092c555926a75002005bdb7fe199fcd.html
Size

1KB
MD5

7092c555926a75002005bdb7fe199fcd
SHA1

3560e1bdb476c15fd63335d4ee385aef3184b0c4
SHA256

da7243524c496e84d41e1416733ae66be8c09e063307b1f204298f49af9bb468
SHA512

8118a899dddf467a767b291d71d511ba1b51550534add1a3b868a948686bfc84203c14311235c5b54bb2e41c6d00b8e8cabd600a181ab181b435ff0466eff7c2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000001db92293038a2b14f1904b39ba1437aa73c24660e2810c3084fd63cfc9805983000000000e800000000200002000000077648e4f6c20be6b4f19916f4f2447531baf9b6cdd5f4d0e9f865fee58a7881320000000460cd9dad48c63837c1f7ffe4c4d4dda38583cdc8529dd3b534a1f5167d6e2914000000088ef6175dc8d1960bc1ce48d8ce2d7f1dc55b008c347b0dfb0c750bf4e5105860dc0f8567653f2ffbb3574aa277d832934a383807f1ba4f28804f25c3087473b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412209300"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f29f1b484eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{470B45F1-BA3B-11EE-9FFF-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b139d18bc1573acdd2238267906b755dcc6fc73f5ce416304a0da5ff55bc7c33000000000e8000000002000020000000e736aa6a1382c198be1b7ab244960efba54f4bf9c7e14c0a677f7e8182145b2490000000164e1c31f9edb5e442d91508f3ce500228b23db7c8ac8da831aec4f2019fda4ea2e50277bbd4751a12f7f1e0be99a7e3785b96ebd863dce884f4f2242699bf7c26e9aa008d596bd7e2ff0e084d49065028344354d2955a70e66ee18e75dbe9e21baf8ecfb1223f72fd6dd27b5a7e72f65e9500ba80b8ead157660c5f77e7b88feadb60e860e7ad10d232520aa1291bd440000000dc9abb6eccf3466a50b0b7f490aab120753e1910cdbe5d2a8f35168771e8fbabbba1bbe4742b1e5b7e4f56d5ec0325dceefff1181b1b22e96e0e1d37af0014f9	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1744	2928	iexplore.exe	28
PID 2928 wrote to memory of 1744	2928	iexplore.exe	28
PID 2928 wrote to memory of 1744	2928	iexplore.exe	28
PID 2928 wrote to memory of 1744	2928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7092c555926a75002005bdb7fe199fcd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b92b6e503c51851dcd883ed310c1d3df

SHA1
fb2f1b83e36ecde22a3f0e6e9cda6494f419a968

SHA256
e5cb0b61c9c2ab595f09d23e38fc4073092357c0608628600b9b38afc6f3e442

SHA512
868e1215018224e964a7af43cc4d5cd6ec91091a8d8a67c4546718f2ac81aa56c1aaf02837114d0d7cf56cc48e3528958b69c3a6e9ebf0eaad550331753a052f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28e40822e6c8c62d13b7cf101d71371c

SHA1
038e9b76b00839bb8804f9fb4225f18a22acbbf6

SHA256
17e5ec02430da9a5af2e8d1f55721a4a1bc0390f1599693da8c52d7bc471e584

SHA512
396221b3c5db5b2d657bf0dadf5cab2975cb2c8e816e6e48948f012de3b78709cdd38e869846f58e4a1301720bd6bfe137d351d9565a0c574d1afa4920b07de5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39e03d927cef367266628dfa0f83608e

SHA1
e47e935f355637ad39f684f446e273b62b83b18f

SHA256
c9ef112488e967efa9365b5b258c0ba90f7008562f96c1f822619ed6badbdbc3

SHA512
2122479c43950c1aff91a298de69105af02312b19c282ba9c44241ee19b09a1a7856e9bd3f1bf078aba3f726f02e3565553728ee458ce9237bdc4a58272d2b73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5612a2c51de7b47ec54242990550c282

SHA1
4b2129de3b18c42d728d18a1fc254ea0792e53c9

SHA256
ad98edd2573e3168dc2bf08e72a3b5f99073d161e10c328fbbe5e80b738f5764

SHA512
04a366e7d6a9a3fc6e694a3a59ba201d11b6aff617bdf98932bd7e2e83e3229a34430ead4aec6dd6dea045e6c990321bfe6afb3a38bd6b56776ea89bb853cc5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b77dccf361c2306279ec2ae95780b78

SHA1
90084dd4167f190098cf0fb11a30377ec6a47bee

SHA256
ab5e5611f9bdad0c9de7bb74a9ec86d4aeff6a802c5993dd99fce4af12840106

SHA512
c9b2b0dcdc6fff4596b74166e9ea355fef0b18fd170e893f75ed31515239cfafe4da1f57bfbd3293834b30c1a7e9a5ba7e7f7283b9ac02eb4e2db0aa02830684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b94d8ddccaf97fc4596743a99b66b62

SHA1
364c47d116f1c246db5311e661c18b1029cf0005

SHA256
276780283d86e56dba39595f28f17278ad21d1ec7e7ecc5db4fe4efc19fd8586

SHA512
5e79715c554cc9d97f50475d716048fca4f5abfc9a8f46347ff24c05d8cabc91e089f2a771172b5f5e139dd61feaf7a104eac03966fbe80a99d47315455c9cad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7908bae463a18a84af3df495b55f73f7

SHA1
254b3a5f19927805066f19e20e6bd58df6850c76

SHA256
acc8590d7d9352b4dd91e455a5f47ee5dd296def4b272ab87b01ae80132d9d5f

SHA512
7ce99ebe6d7d3b576f940214a317c00e39aeb6c47aa69759dce26aa6ffa8d97c1de310bd978c54e51da2a193a0f9d35583e701eb5d6ffdd41198075027a23f96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84d1e99bfececbad4710329227fb4f5f

SHA1
c3ff4615eed0e0bb6b5fccf086b0909cf547e219

SHA256
767c43002d969362950856863f3b60a0e9c540428500baf2b04e9916d53aade1

SHA512
e92d29a9ffc94fee09fede7d8a6dbf724c1eaa09720682c635e2b2abddd756b2332891b88aa2ae2734ddb731251f8abf90d91282a176d8c2fe94c50295210d79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b6a80401ec72c6bbb0fc4db88ff4a3d

SHA1
3875fd34c641cfaa5467c9cacf2a20e5e1f820d0

SHA256
c885a83aa6b12f01a14ab62cc99f9280eae35b9810d50fcf9bc987c9c5a54ede

SHA512
a3c899b7390c2842fb4eba90be4882f1e55070db6c933b74c53c721b55dcf9eb3a470a9d6c2d3b8d9597168c3f498bb981105453a8901158b6f18d56c0068d26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ad8fd4886eed57845f96a93d619e518

SHA1
bfdb376051236011865e1d0d0ef54a7bb1e6fff7

SHA256
6ceb15c0d0707ecf8db3e3de919df083f5d526d4127ba53ea052f6a7f24776e1

SHA512
f1ff5c8d8d74c073d8d772ef56748ef17b9a5a0e4c9fd6a5b1a60c61a6a232141d246178c9aa4cb595c576109076f6d5b9aefbd484ef293910df64581f052e0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cec1b9fe6020c294d82398e2f19fc132

SHA1
d2d09cf1d17dc2a21d2dafba1a9adbc2abe672c0

SHA256
aedc40176d91f08b383126582a6a643ffef486bd63e074476e9d68bfe306e3b2

SHA512
ad152cf6d399b6082f377a2fcab60a21a4075e7f36e13468b6aa0a3f76fb55df0e8b31081d75b030103afda77b1b16a20f0852926a38f28d1b8df45d83eab72e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
118defbaa0b837b0a4c745bb125bc8bb

SHA1
31912b276884df6b169ce4f573cde7bce228ce69

SHA256
e24d2d130c4dc8b263e50a7a05aec9385e939777c0b255ef228fe0ce177e398d

SHA512
dd66928779736237c76b07594354a780f2c67f6ed7fdf95dd8edfeb4ff41f1887f32a1ca5164d31e35ba6a00a8cf9e807fd25af74fb8cbeb0a72fa454e50d0ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c9cc5590ec4feddc615d16b69cc37c3

SHA1
0c156be684199e5c1f0b879c95672e0daa83f3cd

SHA256
b3ad14fc5bf9b8750f93c1fd03bfd1365443251d837599533024596b510bcf4e

SHA512
a8a3cc6139a2220cd36956f0a74c6c314b2b10f170c954c3d49a107a3ec6066cf91146f95ce26c9f66cd3e9a54f6a1f729857554097b4f5b433312806cded35e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f65c742080c887048266512a61ac387

SHA1
feb6a7314858e1ac8d93ed1719d065156d0a2123

SHA256
b9d9e771c96b7cd15a436dc72b096778aff37c2f0c6b17d6ea934aae4de09ed3

SHA512
b25ad4d0b5dcdcb1661f31afd03fe4f4cbac6324b25cced48cfd968e830fe3001bf5c15cfaafd5045235cb687196b68420c9d4daeb551d412528a7af8b4a3437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
411802634d41b93c50bcf487ba431a15

SHA1
f4e6d5f3eaa2442ef6228d80c3eb60d8a5e1d35a

SHA256
c2e179de49e09bbce873b2dccc1fa03ebe17e8ecde17f1da8ba56d30dccde2b4

SHA512
b87ccdf294fbc3136f5dd9ef69ecdd66895805a9e64b53b7c1f8feab4e8a1c33eedfe990463f0fc901fec966b850e4b67c2170680168d033f49ed8947f7c4e6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb30867bf7c65182436d308da17727eb

SHA1
6487835e622c491b7fa781633d8e290bcc7b8d3e

SHA256
22b852f35da01defd08929d5c02286b37eaaa46089c0f1f815e33ea4045e652c

SHA512
9c73ce7ea9c1c6b63730e655709bcc0ca3fc4505ac5b102e44592f8350154489d5a82a26c9b4ecb867fd81f5c46bc6b82bcf55ddd995013922ed1cc00936c6a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2272.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2311.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit