6299c61246e5c1fd6fc8735bbd0c50a139bad3509a8a2e878840397abc862dcf

Analysis

max time kernel
141s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

751a006a6d91a587676055d076c48bb4.html
Size

7KB
MD5

751a006a6d91a587676055d076c48bb4
SHA1

f9af54e433d719f715fad898fd440ab0ee59345d
SHA256

6299c61246e5c1fd6fc8735bbd0c50a139bad3509a8a2e878840397abc862dcf
SHA512

1f443a0b1292e10b10211db37608489add2e5efe40227fc527876872fdf9b421de1bf4b5482bbbcc5c9832ba781f3b2cb7e6bdb36004c0d9bdaf59d94ad64149
SSDEEP

192:73X4UqRZRZBKZROmHRQRut71g/ow18Giok:rERyxd1g/oQi

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412365756"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000013808a08f246ea6a34b59ae2df18423b0a4fef7eac8262b3e5030e782a69308c000000000e800000000200002000000056c2bda1bfac79a2b95583405fb9e041c0e988a97d1bc954c9f2b6596d6e8a9190000000a92055e04d678ecb074207d29a9ad68fa90a63676ab9426ae36118dfd24d7b8dcefc617d3c0daeb0ecf3b8b7c0178ec5054328d35e89337e70e577aae8fd4c0a3f46a99dbe720ae9d4d1ce60fc111270ba151b00f33a5fee72e315353c18528b24c0116bd22b831d3d317a09bf8e2ab4511e897829fd76adc9da977da8f69043093b23560a087f7e06d7552891c27b62400000000e74ed888a8a94911d770f9000c0adb0ddbb9640e65a207caa7a2f34d3b21c7b370bf0e5c40224395413cd2cf9b4965a841e1082b1ead3d97685b66a3eb16f8d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{920DE221-BBA7-11EE-B331-6A53A263E8F2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000066c45edcb0619c87676626769b3531875e113c77845c6003bab33de0c0d976b5000000000e800000000200002000000022fdfcdf9bc27ca27d32a764e390a5b77f509e2c885895ba7027a7735286c8a0200000001d20e028cdbe50d18e0bac457598ac573ac7127687924e696ee611d1529012bc400000006a5b4dd72a3451793ecbcead50101200e4f65f9cb3395c76b0bd3a60ad7e257e03830b9fcb645436440b54318f9f762f246157324e59e419b29e674c56f668d5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80313967b44fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
2408	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
2408	iexplore.exe
2408	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 2408 wrote to memory of 2124	2408	iexplore.exe	28
PID 2408 wrote to memory of 2124	2408	iexplore.exe	28
PID 2408 wrote to memory of 2124	2408	iexplore.exe	28
PID 2408 wrote to memory of 2124	2408	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\751a006a6d91a587676055d076c48bb4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
685af08d657f9b34e191e88ccab2e172

SHA1
d0f2fc9de37672a0b7141a348f518791a998c8c3

SHA256
f34037b429fa111bd47406e223b9ba64183e94fdaaeeb8b29995ea897b352383

SHA512
c8a9ab320d9ab825f6e4b3974f1d1be68b743adec7df19112e4cd60ebab63d79d47783e69c0795f8946f38c705fb8e8d67442c4657b85fa1899c187dec4da00d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cf695fa98e141976a0da7a09b9dfde3

SHA1
c69ed8f2c8633d17eee31ef43c1e436a9ab91406

SHA256
2ee0f9af504498d644b55f5d75e8f14320313bfcde63caed6d3579ec230e1c80

SHA512
51b5ec68e50e3663c8be4154decef8e19407b0c4230636e8a9f153644116d110b2b32aa5bdcd40e0d54645ae5d6c70a19f5b3bbe9551b3b963c0e7f648bb4959

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d65390df1bdf97a73bb0554f316aa363

SHA1
7006884d1a0824c4ab5b2a050891d496526db024

SHA256
d833cfa4d08f718d350c8ca10498c52924f19f5f3fbca5c723836e2868304af5

SHA512
5991002959ae506190309fbd0f2498a75d6f1eabcdb276b9bd153ba4ec5494178155ed85535709fb9e4caeee9e997d6b60bb24583c1c23bffefe027876fabec6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0998ad6d63d7f6f768f3da46493ac42

SHA1
b006698604a004be04f65fe9b9a68f91259a4fb7

SHA256
0172783ad83429a40d6383fa382e631f8f0638905106b98345f1c986d80e64dd

SHA512
9c3fbe42e7835f1dbc234f0648ea1beeac2939edfc689599b7d9b28af4848ad9ee54844e5fac1196779a49a929ec5c3a9ab0a896825f63af26ac6157828b691d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d118fa5f1c42678d076d20859fb11767

SHA1
8e04ca8167e97148b407a92dd2522535884e6f7e

SHA256
1bf1b63fa12e5c08ca6d118ec153e90c372186b63b8e7a4717be135109c10db6

SHA512
007c0170d8e958a7e086b3c7767d2a4766c9d6a773b27ca773ebf16c48052aca8813c118b3a738999b3e22b5ee4831deaf32514b915f95d78b8758155b5bf1f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2adbb15874bfe0bcd5813ff9808c45a3

SHA1
c0cf926954ffea37e4a76cb434da63c72577a1fc

SHA256
96fbf8ed4ef3efaced9b6af20ee6bbc8454eadcf9c6b7b2f8bb7e760ec5f40f4

SHA512
6a8ca6b9e327db0e56e759c1fe804cc046efc8b2b7b16aefd26350ca1ffcd5de9668e41f7700424541897200f1cf109b646e295acaf780f0b02e3ffbb5141a20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dc146447aba6c55e38d5ac4fc335c39

SHA1
983549ca66b7ea7f3604eba66c0d9ee8dc3e4294

SHA256
54ea2b91abc9d7a1b12b65a02b96df8575022c4d65b827aca2027b5427782331

SHA512
15c1ed76a38dbd8d6a6a012117b127f54ac27b78afb0cae88113a1b32c05342f315c3863ac85a815e7cdf1ba1afc5a88593e0f751ec69649502ca68d9bb59245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89fe65d58a3169c86c3b1647de112e60

SHA1
eaa50d069a11260ed11da2372cfa3ada0b738a4a

SHA256
9db2563b7d3d26830327b142ef126478e97ce0bd1531922ecb644df8b35efc10

SHA512
4406e2064bfd102a568516ed25375b0c5fe340c06335a26062fe67e8f1adcb2f94fdbe9d9ead0bce46f8410b389b3f1409c79af517b4961f5bd2a7cefa6ff593

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b297e342ef7dfdaeea7c358c6c90234d

SHA1
61f37ef82520a01e299d71548a486b9e7bb7ba42

SHA256
848c348d244b1f723db88d1f6370683945c649dd87de417d312a7a34042413ad

SHA512
0a9aeb68e3f7a74db9b770dd83b222f6b5227250550b5f986f1ea8c84908cbe08441869bec1393b53612581f82ce6c69037be8ad0b1ebb7bc5caca1c4540a694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d10e4d8ef74022e04cee80d5e2410ec3

SHA1
822b78f1970d4a4afbd42ab4c89e0c259c9b6a2c

SHA256
b0935471d02e9854b03c907f1143fef7b56855bb4d85ae18134da8d0452922e4

SHA512
f8ae59fafe34903e79da7cc4bdca7965401fcb6aa35a101b1a40faabaea2929b563851dd8d74b39e9f69e5ecad5a02ec13b5f2ebe53ea4044a9a98a3fd52a866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49a8b9af8a280d48527472e44ac1d0cb

SHA1
bb79ed779b6c0ed970471906a9b7d585ffe4ecbd

SHA256
334c6cd206fbe15d1997113d26812ec5267ed1625fe2465b38daa3fc7889e669

SHA512
30a5047a6cfd33e4ace9bf66f65fd4f7d760a46901e5bcde0e6805203069839c4be81bf2cb8fc24123d88e7a02e0a61fdf6952d7b63e16ec0cfce8e447ed0c27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b11d64ac7149895d4b710e1b214da7fc

SHA1
c4ffb06b3d0665be35a0e55dca49aae2c9065958

SHA256
73b63304115c894646dabf29893f8b47e82a400b9bc28223187d64e3686631b3

SHA512
7ca3e8ed1ba877572930bfeea619d7b914785e6ea7412d4f2cd124bf9f5bf746714560d04ab01157c0cae84c01cb7cc1740567c44dd4ca26683770aeb0101e12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02cd99b8b0710b10f40f03bb60e62c27

SHA1
aa9d7bee368395f6b43b88aba80358e1b5fc6da8

SHA256
d521eef30c1d821f54b885f05500d3a49473494b16678b66c2192be570eef101

SHA512
cc7ad07a60e3646fc176c04eb82d64dd47c74ba509238bb88329a92cc4f192e3c7a60011a520f540b8cdcb5e36ef4f2e7c0b49ec4301f75b999bc56b2457c090

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dd6a6407714cab9f198a872af414317

SHA1
c39df5fcbe4e984e56c5fe4d3c8d30373a9508f4

SHA256
58055c4ef340f61e7aa0628a5ec5a1e1dc20a3dc32e3df3046ceeebc52d8cea8

SHA512
fd743b8375060098d46074049f771b47963b73d8dc9e13e60e59593e8d423cf7134a2e1a832059d07ce122ed46894c6bdb80228bc6cf4a42ab26a85e610ac3ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d497bf55ac1b0f688929efd82952a28

SHA1
1c5353270df3fc3882cbe10c24e540ea6a7b0b4f

SHA256
1e68bbb6664ae44318614b2e5a63ee5656dc5ec326f8582a4d4d8b9c56c54af1

SHA512
7174d59ccbe535a1719b17bf0f4bece1c20c02b2834d144dcb0228bb7fcfbe2915ca8a24d7dd1affcddede88cbb22ff6ccc19e0f59b840b2eb9f3bb966505a8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afdbe1f3870d3fbd7288a0b47cc0c1d1

SHA1
568971b623a4e293b11cabb850b88cb908725192

SHA256
afa347b03186ce182df3cb74c63278c83f524ffbb1279043f6e2e0ba94b1b3a0

SHA512
04d53759f5cca0f57b86d3caad2622f10dd0bc379f9cbfa6491e86e4853588d29907110c3596198a487f7612d9dfd3f92c111424ec04282bfdb9b9fde53fecdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e50458b8b1a9ee99c0bdd3cd5b8d6019

SHA1
b4550dd8cd6290f8ae69cee71bbe0708511d0460

SHA256
d004202870620a81f5340aa94a744544acb0e39b9879b0e15dedb55394e9b004

SHA512
745606861f6b87a19c79a92770d1397a00b6768ea877bcfedb8bc711ab53bf146b54a75a924a695839a7ba19802bba2cfe70a47566bf2365583b1dbd2b541805

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5978.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar59E9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit