3c101a48c3d6aca17dd012188a4e3327a62d6772fad8631c330cf86cc8c01f9f

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 06:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7696dfbd134d07e4cc4b22d51e5df287.html
Size

1KB
MD5

7696dfbd134d07e4cc4b22d51e5df287
SHA1

06f67daa9f42c131f99bfd0bb58f9c06e01477b5
SHA256

3c101a48c3d6aca17dd012188a4e3327a62d6772fad8631c330cf86cc8c01f9f
SHA512

76cb76a15dc1981c21fef28d7cb8147840142646a952ed05d507b82d8af4515a7e146694085c47eca19c942696165e10b62230370687e19170d713d483a117a3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412411093"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21400E01-BC11-11EE-A3D4-6E556AB52A45} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b80ccf58dab41db82dcf9cc0e189463006348d1aea4dfb799d5920fd834ef265000000000e8000000002000020000000fb768ee78fe1758cedd09b204b2e992af46b8ca7f7225e6d21d433d55f6c0a3c20000000d3e2350c1c5733c4693fbf2811d5d4e2e80b087a0ec72585c3e1940ace0cddbf40000000e83b6306e1e309f7dbbfd423fa2b9532ecf662e5d5a762ede5997012823bd76bb37567b1c5f951d54634beb751727fcb9dc14daacffcf4ea73f7628c7ee3f22d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50a4b2f51d50da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000006ee013c08497e00721dda8d753f3b15d9d14380dea5b22fa54b51daedf0fe66e000000000e800000000200002000000016bf335a31fdd6f59fdd7edeb9282dfb32099cd3371fa10f9e606d040fe755c590000000e3ffa9787d36719db54aa186ffae40d5fcc22ec1bb122b4f012614c1aedebbfa29a6d6592fae3129fd60bf06ccefa4226cdebbf5b7e0215a3b126f2d01c8195ff1a90ee192df2d0186356340a6a69acf6f72be18d7df7b89ff8c024de7fde2ddd2bce5b3d48de432451c677d4487bb4394dcf97e17c5491e73c6f35e8cad8e634c2acb0196e6f4580c44f11b631a672140000000793ab89f246b567829e4c24de70b5669cec0c2ced60295a20c6be3abc65cd32bc4f422e6d2d8b30c78dc1e10169e0b55510f703243990d8254238da2a58e6ce7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2556	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2556	iexplore.exe
2556	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2964	2556	iexplore.exe	28
PID 2556 wrote to memory of 2964	2556	iexplore.exe	28
PID 2556 wrote to memory of 2964	2556	iexplore.exe	28
PID 2556 wrote to memory of 2964	2556	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7696dfbd134d07e4cc4b22d51e5df287.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bb374f052ded4fed3dd3037852876ad

SHA1
db2c711cc45a0176e502d846358467ee3143b654

SHA256
199cab4ffce45fb09dfcf2fcf4fde1d0404c7e814a0b083168c2a02385be207f

SHA512
8379082739ba3afdb8d5e0c5cc148db964d5ee5154a4cb1e5e12390a5031973461e68ca1617419271048ec7d5517bc7d80d78275222fa0e64f2f7df81a0b7ac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35247aafd4a26c6b73e12d754b766f3f

SHA1
f6f821154ee378713a61a7a3b1e0486ec6be780c

SHA256
7199bd77b4766a0d00abfef295d36eada3ca63e817155d44e282f7860eb48a03

SHA512
b36e865176657c409db8250726559a1168b7180cef98761dd6ecd1454b41dc3eb178d50993303dc553f5f25807aaf8bae2dff72599072f1ab9d0785e5ec75d03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b673de20e074a815158abf2a33fa975

SHA1
3b9cd2f6b4ff315a5984255bb108738266d49463

SHA256
9b3612164d3c03e6e808d28ba93c36f7b9b18754a9a8752d8853d92aed63b7f7

SHA512
6266cc0ce21db5fafd688a3b005fd387b6b264588dbc9636e5198da7bf7fdddd856e6accd0a54ee0c458f46cc299b70d1f1a57ff7a5f2f8f37963ce2b697e3b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5df54d6d6ec10450ddba7330d737d76d

SHA1
c82ca8f3e958a0e824c5b46770f6ece946ae0f71

SHA256
bef78335f636c81ef8727bd31f0205ee759f0a80cefc7013a509ddb853460701

SHA512
6aaa4302f17a2923d9f58ddd756a71a219712f6218da40bf89e52dd79e161e0115667a2125928b15ef6ca47e964834239fde04fdf7a9734a54e83a4e8677f984

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f3a7d4284ae56c592fedfd028d080eb

SHA1
4bda27974a7a764129b097af647900f50acca03e

SHA256
f6c5b1590105110db1719bac11e8176267cdd3d5a59541259a453390a53f4bf7

SHA512
ca50dba8e7cf074a8a4e0d69fd09562074400272f8fd4c9182b0e423061e909e77642195383a507fb6a046dc012f1bd3c3a6bfccc78d1366e75d3ae35d22d9d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
369b08a0ef33eda0143c6e8c6e1dfeab

SHA1
7a4296f4cda88d1b98166d6a9edc2209d8394bda

SHA256
b11bdaeef0def53a9a530037b73d439fced9775a6d2aafe305cee51db3c2e980

SHA512
8be7c4d6018f36b33966adc0350f4518618724b7f91bec4acc628fef980b816c413f57f7e0d63196db2de893834751d48327ff3222cd511b65711eb3f990a63a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ab03b897ec95d06323ba537dfbc8d4e

SHA1
e183304b1a1f448c893a7376130179cb2cc96fd2

SHA256
d5a8f16c8c9f29b42e466762ad37acad982c9cef7d6e875aec22510a62fb7e46

SHA512
3da0e72ea0a00fdb3e2682606cb112a05838203fd88e4cfc5326248ae0f3c1094e42af5f7904a9a4bb641e7b2252a821a95db9db1ce8ec7eb612ed3a8f5af97d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea48875cba21badb255a03cf024738df

SHA1
bb4f7e51d755e9b303c260b078726e5e77705905

SHA256
c4f77d6b6f31bb7b6ee73fa08c79f69213f8d921616efd47ffa7fa4afc599a34

SHA512
75e7c0caeceb3b12e18aa612a94d3c0d471ac76cfd37448a29eb53a5c6a9054b6fba6e6659128d5f599d5e7228ad3ef3dc51fcff3ad8ed83127c61577dc04a6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
758f8a11d6425c84a0736214618f46b4

SHA1
a7eeacba13c6e0b976ea869ca1d639f86526e7bf

SHA256
1204fc84659da927281511a9cc530b12f4fef01eee67d86f68af432e3715d630

SHA512
976da53d891b79d20c4555a0981b307aed62221c0a7692323c594408bbc35433b34bb649b7e41c747f237e58a8e8ed87ceebee891c5e42e79e0e33f777004f4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
481ecda6a120fa483dec0afa81ab57fe

SHA1
e153d69ed99b93018b16e47ff4080a2bccd60f5d

SHA256
46eca0c79c677e0867d7a46393060047460be88196aa15142c37cfd559e43467

SHA512
193de0eb1d85a8788f2410132caaf4ef0f172c1be80bc97962fdf44d076b02cf6ed9ce6e9c7a01b35caae347fc8e76c88a7149ae5668ee2882d008bde012170d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e95d4e10c14d8c9954c0684ff594861

SHA1
c7f66fb979b6f09dd74a5b607fb13090ef90638f

SHA256
473ac1c4d3475e9e76296cbf3aab463cc504446036ec759b305476b4b77f09d9

SHA512
fcddb51153086b288d509351162ae022d75b48bc5c66606bc6a67e9664bde2cdf937b06e6ed4f5ffa98fb690fc82f4b529c0eed5fe57768ba86aaf9b4a16c383

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af4159fa5ed71fab379e6486da6513a2

SHA1
bc4bef01ee712c3318d07ddf7f2c01fbf669a4f1

SHA256
e4451345862e5ff6762901f6351859318fdc7d8dde8edf5d32fe91a568d332eb

SHA512
344445126496fed1c12adab95851e92b3479257fdd95d98bafd70ef99e3a5bbfd81d7431bc210f3e3d4fcaba6c2db8e5bbb88d04119bd3c8812bff0723f6cae8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f38ab82edc7d42ab7e84c443e7ff6aa

SHA1
f67c2696c407f27575acc95ec5c23da98056cd66

SHA256
5772788c654b7a62140fc21c415b0f0a71f2a29e2dc9661eb72abf526ba4e315

SHA512
d2db7b6c9fbc2f5f6437438f123ea428a7b4f8a68eafb32f4e954ea09025f1e4e1d22ff56d0358795101b17d319bf0aeee09eef9d3f2dcc089f4dafc6d6ca2ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2206437d435a33727f2bace00b0d07eb

SHA1
58672d4dd07cb1c6f0c762ac8389d4f707618678

SHA256
1c0869ef52d33429922ae29afd4cb7645cbb6f4a48c72609ed113b11b57faf4e

SHA512
2bd923f208730d7de31f12b4c37fc82f57ed3334e14db888face40135949106de976a515cca52f488fd4799772529f9dc5d3ab4d145694f4a60741a0d948fcd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee7e5ab599e443e2c3f0998e0a3fb1a4

SHA1
84513e32d688c03e8a915da5c807790f5d12829a

SHA256
bc88e35dbea13fe70cab4a1953bb488a985813f4ad01fbf2c6aba677aa9f6fa4

SHA512
e83f8ae19d12669b975c5a0370f636dd1704ed0832d2d55af425e12605e7816a10ff35e2fadf16903879124fa7b4ec6fd3db2f490f44c12f2ee924fee9baad4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b95f9447106814b4b14c36d92b41295f

SHA1
2d6f44e46f8558da581ec9a968f3031dbccb3a47

SHA256
8be54ce336c0668ee61ed7885200b745ac50ec64000b3bb8d018e65b10f99601

SHA512
58b1d3434d1612d64ec1ff8b3bcb2631095d9bebfef182ec6f0f2a5d9e3d8ee43a5f6a8eb9ecea481606cdbee7c553c56c83b66a5cc00f1af0a545713625824f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2169.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2209.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit