4fbf859905bb1929155a9379e0575e55e238579c3499f4ea3c3356d014e0c47d

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75155e5274d54ff0ea26daee4760a557.html
Size

2KB
MD5

75155e5274d54ff0ea26daee4760a557
SHA1

7d3cbe54ef45eeb20f168921a2a6d6e71cd16d9d
SHA256

4fbf859905bb1929155a9379e0575e55e238579c3499f4ea3c3356d014e0c47d
SHA512

a0497656b8d32b29071373d6ad453f5f4da36272baa06aedeb9535d4d45944586b217757093661e3c5831ec28e5ea9391fabf429ff69a81ed904764764680441

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000008f5b898778ba4b940b76fe8d88772c52d555f6f9d0bef0161aa183039071abc3000000000e80000000020000200000005fe86599013b12c16d7c730b927ad64b1369c33f8151451259901a04bf7ad9a320000000bd23ee556af0231e61c9ff6af51586e77581ce19bcce38d822f103b04d95a9df400000007bb6ad0561eb68440b757b1652dd35a807562c7784e56c7a2779983163360565cdc3f658db17bacff4181aa0360fa1d882e6bc61668983a8a5157226541c466e	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89E98D71-BBA6-11EE-B754-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000010e38f4a365349789571433b597ae7aafbc6df1aa57462e03d88c0f353fb20d8000000000e8000000002000020000000701e30168789e1fb356b06b0b0c472c4110e152158dfacd1671b61a5281aa605900000000d03783ac9ea32b2dfa80f917efd0b03666429f3c918381b86b2fa91e48ee26dacba4494863af1724001795ac5555ca4f576550d7f5a1b02ba8f9c819f80e41c3a59b9c5f371ff31fe6331f6db4769121a837d54ba023b08bfcdeb99c5091f7528f1b6782dbfd1d5bd106d43a1bc648fe5420528e3b4826db02f019a6ab918de87370dabe80a0fcb5a054a22c272f73b400000005b28f10e5b48f2af6834e011705de50019c4425d1747ee9580445fc88d8e446a4a4a5c05d65aef68c8ad02333043b94d38145f4678e8a8729f3da56f839055c2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0211850b34fda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412365314"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2644	iexplore.exe
2644	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2840	2644	iexplore.exe	28
PID 2644 wrote to memory of 2840	2644	iexplore.exe	28
PID 2644 wrote to memory of 2840	2644	iexplore.exe	28
PID 2644 wrote to memory of 2840	2644	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75155e5274d54ff0ea26daee4760a557.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f85fba7059663eab292b1d929d1af5e

SHA1
3e125986ec4d8941ad0f18960f0bcdc06af4cc50

SHA256
1d99bdceddc54ebce0121f34bc747cfc08af00fa949e023550ddd1cc81f49de3

SHA512
4c4ef446159406c1857524c4c2ade3cbe4d33f84396a9b0d9788c58273990ff830f2da7b80a666102ba197719358432179cf7159f9223af5a16f520c3fcef293

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d7440b986b0ed38667ad09a6e370c13

SHA1
0375d097d6b0f47dfea841d4d57a9ae0aae8f3e4

SHA256
54561f690ecb5ae13751aa1d563fed12936feb7dd726a56a32f20e0393f35c79

SHA512
321a8ef4758d5d320408a1b512f05d065409f23ab7f615aeeb7fb5445fd13b140174be46c794c655a7749c759266270d769c498e413c15e65297bfd396eec04c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6e35c89ec5e7e467321068cb12b6f19

SHA1
6c735c6105f509898eedaefd380a495632173884

SHA256
c9df9b1d3c7c980e75cb027b52021e1b19a260b717a6891224854e254cea5bb5

SHA512
7cf0566a843e40fae89ff440ad9b7e950272be696ccddeb5f448c82e3bf64021d00fec94184747bd05381c4842336c631d807f7322b62f774fd15a9a35aad2fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ae296f8a80d1e012eff9441ffe56956

SHA1
8d53948fef30e4a4bc9294a22b21fa793a99822b

SHA256
f3fd44ca9b23338ef699774916c6c705dfaec5d033ec1e360eb580cb25ecee3d

SHA512
4fb79651fd33d93e807dc8c06967155351fa888e96f22f9ea613f8c3aee81701597dd6fab063b2ae3934975208ee846a5d2f0dd0245769f07032aadd80f138c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72cf663d7ec4bd1d2d1a0ec59bb96828

SHA1
f62fc3fe837966947ec8f00302720613c7a818a0

SHA256
463f6b9e50dbd055b0c1f0a7d73a88ac0f0e7d9217eaa605a15483fc39ce93be

SHA512
cd3476fce577c0c6367bc09aa4ceafd55f44c490ffa35dc8f0026cc2cedd65f067ee258d276609f40ea3aee1b3202e1a1eced4fbfb75bdfb937b0918c1f018a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeb89b593d2c3f73f11f2a08963e21e0

SHA1
9f993b08a17983dafdd1bd58bb31e6898f9f2ed8

SHA256
3dd5c668d692ad625adec2270c6c72f2f201c6f3dc64b9747cf464cf31ad94ae

SHA512
a8348ab1b093cacea92596dada9e7f2a143909405b8c2e8318e11c0d8231628d73ce8d438da95da20d4add0ad7e81aed2708efed417f19e301d9a51f7d70a8c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acd17cf6bf2418f46312cbc8ae9159ef

SHA1
f503bbed17689dd04bba662551021abd1a3820ce

SHA256
815f2408381c35162d57449e7af5776b0069188c67441b3a420f51efb384c9c2

SHA512
5ddf3d24deb856b65e94c82fdf8cd7071ba10484b47cf0a228eef56cfb20a2a4ff79d63e487bc4511f7967b80ee752ffb1619ba5637e45e7faad10a2b77ffbef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e03182e0834dde90634f0aa06674707

SHA1
60aacaabfa3ed5f0b96f1f91041d9ee94be4e7ca

SHA256
001fbeb1507086e24e87f6ad997382240e2bda7b80d252b73e08ab1fcca04052

SHA512
9e3f1e3513915782bcac3628a64bafb9a8f8362d924084b01d76b06e95439511258c82df28c2d1bca40ce2ed75f50d03d78b1d8872c095342d67286c1913de35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03d15f3163b7e1dd0fee9ab58f7cb264

SHA1
a28c3dbda5a2d6ad3286e068bf5a43bf6f636d45

SHA256
b952373e6e2689e6fa325d04e0493cb00352920e869c95daa6f7deeb7a135f25

SHA512
3dd6424664e562f1a656ac2191349e67ad6c582d8575a9ca8083a3388e7cab71d71f793216a7d3df3ff74d881ca2e605eca2012666f116d391423af52deb587f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fbd0a0b9545d4af1bf8ce564c511563

SHA1
a895f38be09ea3088e63e7dca469a2200168c472

SHA256
a30c5098bf0b0b4aba669e1ed0481435b388249dddbae6f3de9d66d77cffd2c8

SHA512
80d438f4febc370fe979ce5ed6357b8268d71dfc9b048caa87b83b60022200ecdd82ea759dc74d5fcdc91c08e41c85cc8f54d3bb8e4347ec60f2e6128fff39d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d272b000596462a67155744bc93f202e

SHA1
b79e45b7902ac96000be4397d10feeff2ef0a0c3

SHA256
747352a18ad33fa605f5b75f57b36cab2c53eefecdff2051c7b137150917fd08

SHA512
44d6de2de5251b2b4d573367c3593a13baafd3967a44175a988bcc071550b43157ac4a02774272071be864c363663c7ddf486841c35e178a92f457b14737390d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f45a82a85039458df7c654d1662a1a3

SHA1
495baeb997bf88fa793bcc75974d6dd375177afc

SHA256
4cc3ab658a45e141e4a03c17ad86e56fddd09e47c767454ad6bf9737bed8ce18

SHA512
6416625acb097153932c3c21bd75b753b25c1854fa19495774b7aa5c9447e7a44e6ecf2a684635e8385fc4e96ffb7d044ea33a7b41b6bfaad480ad7a9e65f227

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f675f009d409fcb3a6ad6deb572e0e97

SHA1
b62062ef8badcfc155d9a9fc600bbdde6426a94e

SHA256
d5179da072025748e8a5310ecf90e6fb681f9074617f4d7d9c4407098894005b

SHA512
7429b9dbe6f70779a32f6b703367b692c6d9a39fc1bab0664d0e30175873fff3e62df98f5d28c516f878bb75213e65b61ae9037bdf363b3b81b3c8915adedcac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05693995f9faf28bb9a6c29173e21d5f

SHA1
997ee20592fc0d44a77d9a563f8ecc943a6f1463

SHA256
836442fd4807a5eed954eecca630f0eaf38e685d37ed7a8ecd93d4c2e0efa847

SHA512
36ddac0a9a0eb04597e35571695a7866150c4197f84b3e749452251023fa7685cc4e0e880d4d0f164045d3d9d7e82934495792082ce63ac1572b4a29447b3240

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79238fe3ce4b98a1cf85ced081888752

SHA1
d8548bbfd7f82cc3a6a53c6eb99c7a614e56e070

SHA256
a8de0021fc354b62232d9c14fddd736705c414ae139edded2af63d9d32a2251e

SHA512
e22d3b7ca7d55c87752716cc521d1ee9b35b5fcea5354f520b92e7d6d982c0a5988a97bb199d1e2e07ae8f672ce928982078b92f46e47a9fd31b978d9a549649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5049f8c9b86a6596c2ccbf1670a1f919

SHA1
4dfada9847bbb71f94a428991bc6b739a6250549

SHA256
8f89cb869a53e23dee421e0a93ae1353941405c102b9352ab89b2f4e874db3b2

SHA512
10d2c2d7a2fabcaef230dfa138a3fbe001538390af6cf2fc3d4423eb57330412ad8becb6679dde455593c2a1f3127ec440bab45135d7ac52de1a955932f83e36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8746ed6a3fe34151fbd4a7a9413c5c4a

SHA1
9ee9a01aa5b256aedba54d0552922528cafb3693

SHA256
a46eefa5dd49796cde66410bdbed1a339f9cd26ce69262d8d1664f12a3a56ed4

SHA512
e501cfb4e2fd3a54d5fec53e6e8eee08328edb8c617389038684c007d62d9284690f1821a9263ecb2c9dc4410eba6ce4ed782b45fdde94d944260b26948e7ee0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB5D9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB6C8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit