80c8456bf3fca2c58a0be66c8827b85aa55f6dd1f01ff91920bd98177834b3f2

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

717dc344fad846a320eb6a4d150e4fd6.html
Size

19KB
MD5

717dc344fad846a320eb6a4d150e4fd6
SHA1

f672c4d970b09490bc699b0c507cce5e5b112f9b
SHA256

80c8456bf3fca2c58a0be66c8827b85aa55f6dd1f01ff91920bd98177834b3f2
SHA512

ea63a38bf196fa4bb63eee6a5c1779900a951268d81ebfe0615fd83522723cff9fb5d5d9ca11b5ea882a9dab3d70eb6db13f38b1bd4581a97cd7696102f3ab91
SSDEEP

384:83u39OdqWn/+E3qk58Uz/0sH+hmi40sxvQPo8QGipaTR:XOdqM2E3qkiOO0i40evQPokma9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c4bacd06ced03706898450dbe64ce7a30252f900f27a7a20e0380f9ea4a00fc9000000000e800000000200002000000020c77d313f8f8c23023e7abacedbc94eae789c2207167627614aa2b23b48891b20000000b4e0751b90822aef939905e8567b96d93c682ad1eb8e4f475779cd7af5f0699e400000008dc0256877f59409feb0f9c0d87c7f0ea5b623305c2c9662e0ef13ab6dff3294927a210276ddb77a0a04b0eb5a537550115f2a4a3eb8746166dde3103b9b25ce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000f6ee5fd266d9eb25a703816414377965d7be66dd11ea88554fdb202ccc64a0b5000000000e8000000002000020000000c9b7b26a448148c8c50d0cb7c37bf437ca170a893cb8ea25b07770db67d87c97900000004e2b0503e456a9aa74defcd50e5197802fe3659ad892dbe0e42c7060e2e4eda4af4237b8095cf641c5e22c7460a28d5d3e267fd79a4a8842fe78a7646ce17c2136fe6da79fd4de29de797427cbaca640ec65ad63e8cbf5cf8f04176409daf27ed7a23836d5192d1e66371494812604f292ab453e6dd9352721897beae01dffea61fac379274f434d1d54f8ce03337ef840000000a7081ce6aa826ca93b1f9752e4daca5d624317099aafd4fe1486a7c0c2abf6008119d075ab87fe22db87fb1b03804cb232e1c7e5dfa70552761ab4968d78cf98	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1025c8de804eda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412233673"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09D8CD41-BA74-11EE-AEE7-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
616	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
616	iexplore.exe
616	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 3016	616	iexplore.exe	28
PID 616 wrote to memory of 3016	616	iexplore.exe	28
PID 616 wrote to memory of 3016	616	iexplore.exe	28
PID 616 wrote to memory of 3016	616	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\717dc344fad846a320eb6a4d150e4fd6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:616 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29f2b3a928af67c9421d7cfe81ef200f

SHA1
c4fc6081d2b1b3b48631675d2120f75e57a8ca7d

SHA256
fc5909ecf690e3623967de802d542fa3f486745fcd55e48e5fcbaaa4aa50872a

SHA512
83dc4be33e6517e3cb796f29bbecde37d26512b02648c2fd288e2c6d870aa47a0ce5e0587180e1aa3cb79cefc2658c9e9574ffa8cc36bd65a9ca32cfe5c44a77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a96073b0f4f7f1c0453b97e8457828a6

SHA1
c86cb802e0e9ec5da0c2113930b1b619cef0da64

SHA256
410bb3ad132bdaee78056c748a71f20fe00dd50ff145f7912d1247db39ebd56c

SHA512
98222e6602073e50533b99ada96b1a06d88afdf70454db93476cbad889026e23d3d8d7449d626d5b67a4ff6ae099d88792a59b74b42c73b4f3d129fff99015a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8875507a6408af8d27f9df61499603c7

SHA1
971acbb0dd2dc71f7a16fbb7e8262d54bcd6aff6

SHA256
f5df804f15c971ab8902fb66aa9fd765370dc9593fb124eae1361d4154cd160b

SHA512
20dccc66907ee9974370d7a6a5836bfb29d1d119c07f75ec010425acb156798de7decbe7f72ef896f7d24b43967a38197a700ee4aec021ae1a2de2c3df060ae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9b13b5ba7203a438d07a45a2e3d86a0

SHA1
999c8effc8abd57f51bb41c3f3951600cd93dc81

SHA256
0b9650174142319d3af22c55c4c5aad6672e02fc7a7db42f613f36a7a839c274

SHA512
9a58453216df76a2568d6dffd7e7584c2af9767720fcca0a0de429df682911d557484e3e04e34726f596ba437f02f4e907c23c61015847be075aaeb90aeccebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df945624ca2e63e92b1220408b903fd6

SHA1
ec62d9f58c65dff5dee2ddb5845ab1ba8b4545ca

SHA256
2658b56e969b4ae360b604de7230eebe4fc5544e79056d7d7e22bb099401c458

SHA512
f9e0262320c10e8252dd91f373499820b3e7de0df206d700c57cf1beccf4c902a6cb87c92c0bd6fa1b147107e2cc6fa3a56408c0c498a4f74e24a310daa53458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60e41a3209f8c7ba22712585bdd2ae9a

SHA1
48a267bd79fad159fced4e8e732f3c5f1f1bdffe

SHA256
7180901a83ee2aa8435d642aa69b2ea75ff29d24816ce085c637fcc7346936dd

SHA512
7d733a145f0e3c987367970ddf4fce6e49dd2070009696f1d4307520375260808d908a430a78a507e3fdada95177cec46645d43ea2175cb5547adce7d84aae19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d86a112e0bbeda8c37764324d99fb850

SHA1
76e0793e994f8af0aafd4f06f606325acb0cb394

SHA256
3353a83dc78acc8077ae2f89a59783fbf2e630720c237a83aca9070c2e7e1877

SHA512
910870e8472aec6ed555c77fa2064fa794a09d00ab3254ff24ca4f6ab6374486300b689bad10279c02460521bcedfacd6ea728e70df4fd71934bfad813c15e84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb60a368a9bf9ea905d7fea28f15e76e

SHA1
5583f9c38b1050c3fc0bdd6e43373f38212abcd4

SHA256
81dc8e43a8a265ccc5eaa400870d708fc01ca1c681d064adc35f701be144c470

SHA512
34590b6d391a43ed4251e80053683fe9e7a563b99c950294a48c77c0b01eddb195e7b03723748850b659c9d0babf56b122c270b6d56a98c40c5ae0e04f4eb5c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30e9c366c2e83d501bc56e46d22951a9

SHA1
3944858f65f3957801408270d2ef616866aaecd1

SHA256
99dbf3421b423f87e2e87f53e951aed9cc058e93ba273ea03ea1db825ec8d2c4

SHA512
d0689acf2d073a8a9d9cad590b2083ca063b87ba358a27d7d0f1888f821b14589c1cbfeaa95d19fc224b5cfc7cdfd053a286984a6f27010a871df492597d68d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d574be3e6775b4ce056a92321714ce24

SHA1
9de5086cff9bc377c92b090ae8cbb3a3ae527e52

SHA256
c6d8dccb283e62162c682c9ade6ced0e56b4a2b2097de501918d14e74c556344

SHA512
18ef4f2736f9e3fdbc5b784cf2cc19ce45ccff1d0885c7554870f3ed8fe3297395b552a20436d9bbec5d9b6d970c898006851e724bc516104c9c79e1ce8d7b77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adc3c9ca2640d6c5f27a84ca9375dc22

SHA1
fc3d083db5a35ba5aa969ac631c8669625f42c23

SHA256
45f1c0f57fba8eb340ee9baac1ee51b064e1eacb7e54be623af526086852c94d

SHA512
336292f9d55b633dbdea5bcc3a4e26e6911bdafd7baed34e0679bfec7c591669b55012c212ac35df9bae0df656f112d703719f0afb705ebdf407b06006751b40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0caccad344bf2dc71b5fba3d55c56c17

SHA1
e76be661b633578e3f159040894af93a20d678b1

SHA256
bf76175f852cf40280f529813edd653afa74b27e99bcfdbca4a492984713118f

SHA512
e085ff69f1199e7d80cb0cb18a9ddd1d9469bf34854b375651448e3c15277feddcd8207595bf5c6d9b581facce711e209f31c73d1f4cea208884f066f512d2e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25cc6d913ea5b994468ee4d8a842d185

SHA1
2cb6e2a1a82fe8d6dffce86934bae08ccee3f3e9

SHA256
45cd0fb8995ce5df21fdcbc65eddac3b98f52ee6273f4afd3a333a3ec226625b

SHA512
09499f55403bc5f2623035905fb4fa4bff6a9f1ce8ba4e4204386fe19bd297d075d2a415d49b01d7959c055311733fc3a27c63ff9020d801ceec4fb31dd833c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6887e08f31c81bf7253608868dffed89

SHA1
809915380575e312cb00b133bd2a3f23427571ec

SHA256
f58111863a64b234c8149b29f171c75a7a57e0bf6d97a96a5007b9f9f876048f

SHA512
25b397a35d08b7eca66f25567b2a9475ebe20d7362165622b3a4daaa57cb1c2b761a6ab189dd67a1eda8cf0bd03d4ea4a9322f2d81755dd09806fbc0f05257b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5c3607153beff5b6937f4c54479713a

SHA1
d031f24567297f48f94bec75753137b1976e3094

SHA256
91a7c482a03a970336bf3b4b14412be81b8e66e901cee0bfae651681d525bedd

SHA512
8a767fe370c9e07cfbff9a05b013016640552a3fd0c5aab7d5f5f9e34477dec10889fdba24286884607e39856671f25e804e7b2f742c218710c30e70460ce4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab736E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar747B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit