85d1d0b91a2079a6f87e3befaa870cc2fa8fb1872a7b705d4b8475c754e0fafd

Analysis

max time kernel
139s
max time network
136s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

743732c8a440854023abbe58d1139b68.html
Size

651KB
MD5

743732c8a440854023abbe58d1139b68
SHA1

65d1749e120213602df59c2b433d72dd0ef2835c
SHA256

85d1d0b91a2079a6f87e3befaa870cc2fa8fb1872a7b705d4b8475c754e0fafd
SHA512

59af9a975e91cb2a21938df956e889f6c7a5992baa986481dee767aa3eb4eee2a013a92d54506e4dd58edc4060f5a736ead87599aa369bf2f1136fc85d8f7af7
SSDEEP

3072:09AuHaqLWZtNiZt9xTm5FDCrpgGi9A+qGtyo:duHaqLWZtNiZt9xTm5FDTtyo

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000202b79cb132f31a61233b1c51aa8221d8c18b6c9f281f61657513215eb584b7c000000000e80000000020000200000006d868f47e4a7c51ba6db338af0746d404d2d330d2530b79e8e8c232c4c4fdc12900000002be50d1623e2fb109dc80b3fe7afc7fd80a1ac7840e031f1256202054d42c0f0df9e90d52029a7020191870fcb47a461db9741a9a8ac42186ca5362fdceb331c79c27118a836b13900308297a8ca7badfbfb7875deb9a0ba4cdf1c33d37d22665bde3ff951b17db14a04be984f6f22d1e4a535bd3b25f9e9ba353ec7a7ffe42d7d6813ea3149a043a32c38bb1ff87d3840000000236e408285a994c947dce41b6afc625a913b021e13a39409e44d0423a65505ec2b71e673056fbcf5c5ee94cfa47e2989e880c831543d128aa209eef90c2a4e7e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000009927517fd4773dabfc6867b924f7e6b077ee9717e5ee10bec87e9accb6d6c178000000000e8000000002000020000000005ee07ae9782eb6ac5a5c347904cfce6468f040a22b09fe31ea1466c8fc07bb2000000011762be894eba3d2e1e50d8b9ed108b814c9fae484aeb2a2d037da48dd2925b3400000000edf8a776ceea8f41fffb269750ef33fd72c99cc4954f943f8c31d6a51d013afd570234b5e0d507ef44b563cfe4f2685f6e11f0b2e846c19d38c8d4b104c6115	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412333360"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b00b203a694fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24BEB781-BB5C-11EE-B5EE-F6E8909E8427} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2344	iexplore.exe
2344	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2964	2344	iexplore.exe	28
PID 2344 wrote to memory of 2964	2344	iexplore.exe	28
PID 2344 wrote to memory of 2964	2344	iexplore.exe	28
PID 2344 wrote to memory of 2964	2344	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\743732c8a440854023abbe58d1139b68.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
65173ed34da49ebb7a6518b0ae164257

SHA1
03e51ab363c58a777ffadfd2fa4f2b4915ae6a99

SHA256
6d287488e0d5b2bc99490504a44919cae3d82f44c6deaae9631904d50d1f3f00

SHA512
ef3c2d980e62a53af7504710a2449d7a902de851a035eb976eab040a95f4444f3767344254e3f3517e0cf102d8079d7f2bec63e5190e50bbf2132c09a842bce3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5646f1e6249f7ae8aff6d8e80d9171d7

SHA1
c0c0edc6aedcc7010e072a1681ea31e7bb22c7ec

SHA256
cb2f49ffdb2477319c63bef45db791f5b20e26b2d16bae7df4dab30a35217c7b

SHA512
3486e19f7d5ddc7cc3c2ca05e7a96efcb7c73f12ef4636a6bb171bd30083c5c29b7f9b3b89ebfddbc78b2c31e8efd888e10c36bd6d68a500095af7117b2d5e7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4691151154f20763ae27cdcbee1fa8fb

SHA1
fb53b62c09b0fe7620ef44cbbf1de36581a159fd

SHA256
3becb08c2007a021661c033893bdf341018a34516003e27aae7524f2409ce61f

SHA512
3a59efc827dd5b0305ec83ffcdc0f67128b51cb3badb1848bec5c0104ee619189dcb0744411620fa66ccc46236a53dc249ecb37bbdc3d88239e2f064e5f11b62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
603d28b9c8819ad932a2d363af7c141c

SHA1
e665b0b088f5755a0e2cd33eb796394695b43d7b

SHA256
d6fa4b8dfb2231202903d94f1c08373f626c4c9ab342fd4c5e1309eef76554f3

SHA512
bdd939a46334a432d3de727aa80e379295fe0ead0366864a5613ece5225190a91d2bcff501568da234ec364fbd2dfd5da874d2157364569c2db9f4f1e0916294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
702c2e3ac9cefff775c45dfcda4c3db9

SHA1
fa62c2339d39c78f41acbd1e50c9926bd43034e2

SHA256
55a258ce7ca4ab6b19ea76b62c3671b19db269859d04db237f8560b43b7ea924

SHA512
15fc5d31493ffdd96132f89a5df8bb0d03f01a62d326224b763c0b848a40be1a1f873eff50d1914935cd11ee78fc39b7290b1e9837ff142db9f95b0ff1d36561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee3182a6c369517b6cf3209ab4c7a775

SHA1
83708abf29eeb2196cfd9a5fbed90f0583e07993

SHA256
a68708fe9a94a25d940999c4b2f1f44723ad9abfd04ad450047c7b85c1a1039e

SHA512
40df6fca266fd1dda863a3bc75e9484672f296ebe8961222da2be25b75da67559bbf82b73b58ab8a05335d6e42d1cb65ff4eebff722a641a083cd29cb194c073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df2825ffc9cf98abfa67e9bbc8d09c5f

SHA1
a1ff7a316dd4b69de45c7ef9619ccc8de414a59a

SHA256
7f91ecc74832b0c04462d5410737798edb439132c40ed3d375d175b101258b58

SHA512
f44e5e05437cda9594e028ac5acb67da56f508f9302d6c8d0a91c26a082409817e099eb16cf51dfc1b426c2c3caf79a93ed833dc732f3f26fb373f86f4c42cf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca3980570738428df917965b4ac4d09a

SHA1
67e936a6b8cbacf4ab1d8c9be25be468f88ac667

SHA256
81ed960062a72d12bbf54a82b3d53b6077fc8dd6ed0ec087b30242c430327fb4

SHA512
fcce5dedd70c3ec4057ad79e07ba34dfb6bc6def052e63c7929ccb98c7a3de78a6a546a92f3f2c90ec1c3619e12c45ce479f81bf119ea9d36d184f9d0acecf40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b326bd7f1058020586a363aaa39faec1

SHA1
9ef0b0fa7ec680895cb30f8e733c02899e0d4005

SHA256
1bbb0cb389ad2f4ee9fb8b51f37efe8919be0ca18f4af8e00a9a8f7b79a024da

SHA512
11846557bcb2b759562a7906a1e0213f17fee0121c3c3853effeb4465d9dd8a6c560b3e779abf8b3ca21aec28c9a0fd549fa4fd357ca1a910a39c0b8b7bc9758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
658cf2b47037f9c8126411e3cfc7c3df

SHA1
bc8a66f23400ce1bc09a6f386a1805344a3ca2fa

SHA256
490712ae9ed92d79bef5aacdf7f3cfe96ad76f58b34012b1da244e07bcd97391

SHA512
1e8b926d0407783e197d39497d8e1ee4707765ccdbc7842411fe198d8b4101e221a7f579900e6949cb7a0495bb4ea58cf96e1fd3968af00d8182b5e66b69cc53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8FB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit