9aa014fc07ba4d4b9fa8f88a28beabf16ff5507fa0d7aa903016ee89c5770172

Analysis

max time kernel
135s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ba29db3567f21dbb473e26a02bed4db.html
Size

12KB
MD5

7ba29db3567f21dbb473e26a02bed4db
SHA1

721a53ba34d03b0d36e391a7b95f22549b3cf3aa
SHA256

9aa014fc07ba4d4b9fa8f88a28beabf16ff5507fa0d7aa903016ee89c5770172
SHA512

fe3ad2678c958575ba3f8ed56bf225253c1891ffae384f21044eb12aef6ad31af5365bb7d57dd854a4dc864b70851eb033195b9e70dfde6e959496c9e50828fa
SSDEEP

384:+3wgXEugQtN8GrAddlFGGOhpkQCvgwS8eYquKPI/865OtZS0oQZBbK1:ngXElr0xI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000005c214ca9e7d4389ac8096ef66d59dc7f1e36f03dfaabfbe0d82efe8996732d2a000000000e800000000200002000000058c3a933cec64d1d884f12e2a177c620b723d6f399a8be7a41c2dbfa294f16c0200000006679c28193fb6d2d14befb7cda761adffeb7ad6dc0045af09103c60b8d3edf404000000058d54ef2fee3c0e024507c94cd00c26f41d98762db5c0201de406db9e5ca170aa51bc64ec60b15a42ba6513c7c53cf50f3dbe6c7c135f5ca1e105a45055435ff	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412562262"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{18318261-BD71-11EE-8809-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b809ed7d51da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c22cad1435e3ac3d9422a181984316fdf0af7304652bea28a984c1a2b22f5ffe000000000e8000000002000020000000f0cbc088a19fe08bf6922282db08a78d13fe40ec084622619270eb5de6843db790000000e49334b246137ebe2864d08f07c6803b4fe54ee558ae16a2f2492a28da979f82625e1553939c64f255a9221f7aec509f2a92862bd63ba2ef558818283343c01fd6dda62057a98566a77d607cd14fa42757141863ddbc5453708418a32099ce3f8e3e0803869aa469efd0fe7e0e044318b5a6ca84f894c355822be6ea1f1b79ac0edf6266cd92715372d9f59cd10c51c540000000441dc1ad2d49c9859e6de15bd5a2950c442a64dc0b40085a54033d055f154a7453fab539a8d69257f4026793b56880f44bb7f4fb728ca4be29545e08e53330a5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2380	iexplore.exe
2380	iexplore.exe
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2392	2380	iexplore.exe	28
PID 2380 wrote to memory of 2392	2380	iexplore.exe	28
PID 2380 wrote to memory of 2392	2380	iexplore.exe	28
PID 2380 wrote to memory of 2392	2380	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ba29db3567f21dbb473e26a02bed4db.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab731d87a55fb6f7b817a2fe11ea68cd

SHA1
5d8ccca2c972d63cd200c543d9e86b7024f14c91

SHA256
fc1b127354be1590a1c866dfc39ba7a1955db6bc66db832690f4ba135f5c178a

SHA512
ae4f5e85e1ce86fca27fa1e4693f9d28b0de2c2a6b33a95b1c774b675a2eceb12fdeedb1e45ab8badfe7275734a3f41c32fe75c3a16a1b6f37d9627388f471cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fe6453ac504b4a81689eaba18ed5dbd

SHA1
b576c10d15be7b7377bee7edc01d3d5b30ac7d54

SHA256
fa0089680d62e3d3f46ed782106f60a940f93bedfcbc0bbcb3bb5316b42a0a87

SHA512
0da4e38972c1e5d1f50f33364d02c02d09548dce586495a12220119bef63f5339ccbbf499d60c12f700f8c2b55967263dddae10dcd33d31df836c43bc5503a10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7264c27949da95508df7ecdaec18ed0f

SHA1
0d52011cd7b72859bbd5bc0dc567b94109a483df

SHA256
f58c0dfcfeb851be64f3f9386b3545ad03041680e6d09b66b6c24286f4f99b26

SHA512
739dab37057f66578bc4691a2e2e58e25261c4398eba217aaec09f379335c80ba54dca672b0523614a4b4e2d92a3fdb2b1d53433411c18e3c29cc22dead2ce68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20bee46b50c1e13aebabf01a8079ce44

SHA1
a2da41b390b786d9681094face7e8f464b872867

SHA256
3de83f264ce1966394d9780c135da0ce53a5a4359a5d31d502e04c0515b3479a

SHA512
5df7026d6bb477e5ce58cfbf88434bbf5987069be22e56eb4fb5d41a2e20cc73cb25f4bad017524099b239144dad047b021ab1afb6331fb579e4626aae188716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f836cdaaaedfc9f62b154dd402cb518e

SHA1
375f9df11faf682c61ae061dd2238364339859b3

SHA256
b712b699e8e3b0bc037745abec84923e0e1bd241b5078e1d817d6d7757aae446

SHA512
78bca097b29bd65a1f219139b214aaca6c44942f0705d7455981a38f90683754595d85d420cf96b4f4a6ea2f125cb87c913bddb69979fb4b04a44b1bbdfb97b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6f9da9c416ce871e30013fa03227f02

SHA1
24d352953cfe5d6f37ee73851363c1912f01773f

SHA256
19073ccf370a40a9f3f4d74322749ea88f788f7f9a0b7d1caad474a0842abec9

SHA512
e8a5b401af50260560d515730668c92d647317c22852c78c2cb9a14c1e160c6e85dde44bd8c02f10f7f8ef3ffe0be5db840c014eab3bee14f7a3211a1dc20864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9800c29ef410b53a6c328517ec9dcfbb

SHA1
1e2f9a67a375eeef17b38b0b23f5c8c1880facb6

SHA256
1e9c6d1efe60f69f5f7a67ab1f158adf1ab989e972d97ac24e65e02699432449

SHA512
70e9082d02e5975128d134f90b13861bb1dc4130623686675f5426609d96e1f9c194e0edc566458f2ed6ff508a8e8de0345624e891519aa82f6b85ed76c1bc3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a0d9f0d908d72846d787d49c7e6b3ba

SHA1
37e4ce9ddf006eb8e683af9c6659876c4f2849cf

SHA256
908bf3a4925b8759005e230a5b02d571eadc50af1d534ef329c7248aadbf8880

SHA512
bab68e93a87a44edc00bcf41c529b0c4b356ae7117531e726e2167e57c44bba8c11852d3e7b572702e984f1ec6a69a591404e66a1f82ade9715dbd7e1359be59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66c69b7a3e933eb5e34962306af84dc7

SHA1
7349e7018db05ef6fd426b033c902ef6197c4b4f

SHA256
1fd50a244dd863eda25066986fae80ea4715362b5fbe61edf83b5fb2569f92a3

SHA512
571dd465c693aebe6447949fea0b25a5ea47491ea73747f946074960bd30c24b73f42067dfb33f2a95565a220510413d29a88bebeade3dacfdaed738e4ce97ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d191f4b099af59dddc53673c209a711d

SHA1
498be98a9db03074cfa681efd9d4cc2ec0f03ad1

SHA256
f0edc030ef092ac2944594276589947a361a0e8a9f2dd22b25af6d4d2b5206b5

SHA512
047bc72b1cf21935b80ca671f172055d328edc1b9575e387621d5499b225f8e30f5d549799253bae21072ff6559b089dfca39160c2294adf3d05de32ca5faad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
387358e14abcc93921c1c2ee59dc7d20

SHA1
e6d739612003c14e6cdb31c4fd8334f4a87e9b28

SHA256
a5494409af21b0ae9d490bc64ebf57974950f55739cb57d258bb16aff1ca415b

SHA512
e50ed0fc7e88775199cf1bec7aefef9cee0974c5ee6158f0991c630a31041e040945469901e703363eb56f3bd29aebe409259f86498c915d0ed891af7e71d86b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87b8c095bd753cabe03c9b29140fe0c2

SHA1
b2eb0def9fce188acfd2ba4e556caf43b97050c2

SHA256
fe21edcd89c3adedced9a3afb6505606333f600af49727de12502c60d8089789

SHA512
e0dbb0c6e6c7dd8c5c87ec93a996b60f92ac5adedc512643f587011a8e4fdf9a0598189f3e328a7a272704b0c72fe423486415dec10c17b82b75dfe621c5ad0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
462ff079cbe161decfa10fbeb06d81aa

SHA1
3b899e2fa0d0a42e52626328695ff2817106fd16

SHA256
6b0a31a8d931afe1deb9ae85dab1684493d123ecb30b8cd44800aed42667ece4

SHA512
0f7d44e62d8352ec71694a70f6108bd32ec6cb9359f9e5757ddcddf672cf17f41e1861a64bfd224e743970c22e7b3eb8dfd5fe3aef60530997bca60e738b7a5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88848246899cc5f21533d51813b74269

SHA1
4f09a712352655951b0add3b12ae2e428e7b872c

SHA256
e2e1f3358083f235f9372f5f948fc60ec91848dc638eec48678604b5c2efbf97

SHA512
db048f9bc3025deca9defe1adb800686d3083fd9ebce23c0cf30d87000972981b255922e0c62a5880d9223470fffc271a0f265bfe237eee025542a243ac29435

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62add57f1fb6082e81e3aca1e2e843af

SHA1
4b991f45ce1ae493f632e61be7293d716d8e7ac4

SHA256
8d972acf6fe327691e3a29f4e8ac8f0185648b49ead68b0d1b49ff53945adb9d

SHA512
3fee6bb698117c39b8496bab079a521bc21016b87ce81122e6cb9563a67f134034552079df5fd25e81c13af799372d8eda239d1d4aed6dc51d73ac25f7717ee2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24e49c1667b263a3be45c1f16808a703

SHA1
665197575a94901792bfe6527147baa1aa7a0e38

SHA256
8f944d761e85aefe3bcb8c6f3f31a0f713c403f39da0f909b3ca28cddc68affb

SHA512
420dfcc86a22ba52766d4f8c2c823a05f4024d5ea6669f9343ae433591ca0b928d027875444bab3613dd516f50fa1242172a0cea243f89dee870eef1d4216d85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4f79341acfd48f34d34fdefde662220

SHA1
c6c2d3f1c696b39962accc1a935b70e7e95a95f8

SHA256
5ece1272d3efd001d59adab32aeac6b3eaf7e237b2cf5e00c15568f4ed6dbe8f

SHA512
34513e7a281b6c539d8e7c6c5bab222d0aac2798cf15c11cca6f506df9d2558bbb04d0279aa6b4f01c0f8d28b33919e4f130bfa69132e535912b421cd8d823af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab54B8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5518.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit