e92f1ad046ca315a5f52a351272794012922bbaa2f4c6c589fef845fb541bd69

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c028e47f1a45f676bba2ed565847ee2.html
Size

53KB
MD5

7c028e47f1a45f676bba2ed565847ee2
SHA1

dd987257bfcca7f216f5d1683977704bfad93cd1
SHA256

e92f1ad046ca315a5f52a351272794012922bbaa2f4c6c589fef845fb541bd69
SHA512

1dac12148bf16c2ac21f4092944e1a6ab6c51e06b613c9f004e38d753d058fc1181da328daa2dd812892d8bb9e94196161e53443d73c8f3d9323edb2e7af022f
SSDEEP

1536:CkgUiIakTqGivi+PyUYrunlYq63Nj+q5VyvR0w2AzTICbbUoT/t9M/dNwIUTDmDL:CkgUiIakTqGivi+PyUYrunlYq63Nj+qx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{449FDA71-BD8C-11EE-868E-CA8D9A91D956} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8055351a9951da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000bfde599a328d1573183b7c62397721628009c07046e0369443787652d5a79825000000000e8000000002000020000000a5222cf2dcb4e22aedc600a3c41c82fa59e08ee467951f9789640e6a9017a3bf90000000a7f1be32c00dbc9d438aed14279534255d1d0eda9a6155b1db81a84b155666c3274eaf24d172ec565be709708e7e6ea77c9f78caf1c64d2f8f6cae827185112b7e75abbc2b0c17f79751e2990f43ea6565b82bd8759b272fab4a9545edb55675539a374b400ec3756a937fa13efa18d1c03cae3f033ac2a5f961bcb0c5a8b233c4a80942bbe633b41c87f656ded767f640000000020f6710dee53254e1cd2ef2a8f5b8a47e118503003902a38e47fb337b58a446d22c5adf7c36b8b0dc57a3e66fc594245ae63ead4a90921a66058523ad2f1aa9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000003e742f2395b162ec335f7b97ab37744e1ee97b8ff2e0effc6de2c5d67b2462000000000e8000000002000020000000baf9ef67b835d2e03f495cb7e204bae9978ece28be1ffe25302f46906a581beb200000009449e75b1fba22dc8c020fb1f25166dd22b51d89d6b629f1070ba95ccda5575b40000000709aaca25bbed95fb9245704176e20422fcb7be521676fb3c821e6088a7173acbf67ac50004c1bbfd3a08e6d3cebbef24afa396a28f2c537545e698344f81d75	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412573933"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1756	iexplore.exe
1756	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2696	1756	iexplore.exe	28
PID 1756 wrote to memory of 2696	1756	iexplore.exe	28
PID 1756 wrote to memory of 2696	1756	iexplore.exe	28
PID 1756 wrote to memory of 2696	1756	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c028e47f1a45f676bba2ed565847ee2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1756 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f62e34888a0342d25490ed6c4df240f7

SHA1
564374a9ef4b8df7626d9cc782138134e76e6d7b

SHA256
88be3071f7a074dcc9249575d30a14394129d96f7d63ce7e723386c988b05fd7

SHA512
2ab0a06121d5a7bde167fd7cf26a0dfa1315f7f13e2019d30f6926de5c9a9feaafaa09c28cfbb4a3597b5664f5223e955450e15b0f8b048ba75fdd97fec818ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb14a954f3693fdc3d680827c7291903

SHA1
7aa71497ed5c7a07f5ed8c442e485185da96932c

SHA256
bc48e3967bfd8a4456ab20046238dab1ad407f0d45d6cb09882a89c96a6a3973

SHA512
40ec5dfc65ac62dfe807dff3b87c2c4b80b5a36fe3b70ab9b19b970e5b40773210ab7a7c6834d133676a873d58db6c4a4c905b09ade8af495bbf97d320f0d33b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c4fe03cf3f404e2568f046a236119de

SHA1
1770f2ad6e2ae4fa578d52ba3785207edd33d603

SHA256
b3d31c6f0a7cb162e86c514b68c4021e1a786c619da5ca5eef0f35b1cccf33f5

SHA512
4a4c7aa46b5a55a1489807457c7c2deadee020f807f35bcda901dc3b318c44bc0e14dc5b35d17392f81260d559e4ea05053d7ddac87d3e436dc6b5bbb51d2fbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d518d1e77a25af4e2a7cd507ca9cb602

SHA1
b0542c316eb194010566d368e441fa9c6cbcecf8

SHA256
47e4afc80d0d00c6bad502c8c3fbff6f3e3e8765fa31e31c3de1eacc6440ece6

SHA512
4b175c041ff884f41d0da83b9945bd27d583526866210e1a81f6efe1d4312e67ef2a8410573f7771e1e0bb90fefe1e1f86c9508739ba8b94d85888c12b7c54d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf0e07e64b99c6a2fef71708e172d60b

SHA1
8b5e2cddaa030a38dd7b8243eb915d489500fd4f

SHA256
a6273d16766e9300656ab899269a9e193ee50109811d5ea7c829b8b9a7e568fa

SHA512
167632132e9ed48dc304701518bb9a4793cabf5f86d562d97aff9a54f9c248786a5f835581916380efbfc263e9d2221e13c66e7933338a697693c06589f716af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a65e5b24bc43ae55f6b5420a773b4dd9

SHA1
4b0b69c19c1081d560afa5e06879d8aa44c6034a

SHA256
bd1bc879d23d8d4d4b3797b456394c9bd1faf44d53549a372891b518052b5706

SHA512
5d9fb06a6ad4f08ae8006d4cf32ef96bc647a41c99e8346e5a9f2813693718ded10aecca59849e6a98b6b5f074aa8793f7cad2ba2b90b64301455c785ed843ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c58684a82fdf7ba5bdf3b5842cf8330

SHA1
e6a5b7378803d0ffaf9ee1fa882271286e501db2

SHA256
89bb3c1cf4df82aae9bbb8bc9e1da347ce20f56c93f27f5ccb402b8624783ea1

SHA512
19e1505261e5a97594509b8b1dd1d318a2a158ad417532854d4f852cd675ee14453b6f5a86d7f3e831f10bddaf256961f0d83425e31ef305f552e6d05d7c09c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cf1a4d35fdbb999c3c70c64b92010f4

SHA1
13786a6a5d5b5470ae6894febafa1ce3c63abc3e

SHA256
78ce95bb204392e82c5b4e6ea49be16ba367316492fa5e5932703660961925d9

SHA512
aef3b7cd14e36f6fa44aa73dae0c8ff7f30e00b1968f5c5631c285b70a35d3ec1349ff10283f4ddfc73426a491ec62ab6d803f36928d0e5d5fefa9daa3416a4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
580f9eb6da5c4f906fae15a39178660e

SHA1
0cae8b5e22c9b322149505c35ddd247286403e1e

SHA256
2b5974af731a9ce4e209b2ffe72f112bcba55a9388c883c0c333f32d164e6f68

SHA512
ad7a82a4eec667f0aac7944f63bea3e5ccda581433703a38e3ba4a77f36a63c9aaa47a46539ac8e999c616b3a2968cb41b92c00e07e525df4055474af38fdff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cb2b201521d24df092ac1059e79d913

SHA1
80b7b1677f62b60499ab689d8275734b6c247053

SHA256
e2f3f18d15a9edb9da33720d16acf3848d31603c54c4a1b57543807ef700fb55

SHA512
8ae20629191c587ea165f8238aa041052f22bfa2bfe30ec9e39b071a2e205d715cd7e60fa3050b6718bb0f33d4b96bd0d48a067da67e412e3c266f14a389e390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbe83609561049e57f4e4fcb27088faa

SHA1
3fa66db1593566624e9a4a2f827ddf23ba63ec18

SHA256
d477d1e4cbd23576e8f41e60da1bb006a5a630574d38839d1c35718dad4807bb

SHA512
057c1b595a066c3a438dfd68221632b96576b919145b5321d521c716dc132507f53180bd0e297fe991822b18d27f8da6eea386f6a4a081ff2f295d941b69f0a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b71ffd05ce2f5ca6ad8ec86b1b65288f

SHA1
8e364a333282f50a2605bbbcd8842c68268c03fe

SHA256
bd344a8a76d2f40aa4c11d208d8e6e0a2b900b66809617067e193fdd6905f40d

SHA512
1a242ed63762bfe9ec88d9bda7304a1b4d875e789ca8c28a9ee6720c5f01b2aa40a019e0e43967e4c2ed8297d716fa0aaad14fcc86091fe361c7728e76b051d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca970c5b920095c6125c032e9e8a9239

SHA1
d37727b46ee4e952a18dda9b216a523197ce1d14

SHA256
8d981ff411b284a39873db3ce10d7cd24fdeee49349eea4cf2defd605fcea021

SHA512
00cf17ac7135966b0a8fa8d2bcef8903033b3dd22e7e18404eaca800f47ddeeb8a3093de25e9521b80227b61ea8c1d123c203129bfd72a0328e7291d0d4b6748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbc09b714787a336ede4e6dc017a7cbb

SHA1
b71d2897344e73eebb59a923290d6f7d884daec6

SHA256
3d8fa04de949b561c3ef935053a223e2b262105f45491457d1263067faf55a52

SHA512
17bcca97918b2fe72e3210cef921ce46e0b139a69d5cffbe04e316120b1db045353dfe77ee5505cf6a15004aaed0dcfba4ef7b05e07c49fabfc433129a809816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e18b0c56477d6b320f37c62570d7a411

SHA1
054f10999645116239e8a6343e127377c9d1934a

SHA256
d94b1ef7f2939b6978c8f519598d563305eb4bfa951eee3d36ab7a805d4e55ef

SHA512
e7d4cf91f8218f9afdd6b61660055885bea54f4ae364db5797a86121cc7fb75de909ec9ff4ae2108c07ca630928e78d598b4b8a030987cb6afc274d7d46df477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd16ad731cb47b0a9af0bd409cc37828

SHA1
e28e95897d005d27c4226148fe8e2eaeed1a40d9

SHA256
e6230f82c8b78eb6e2cbe0024da21b09e62e5851541853ebe00c0c906e77c499

SHA512
addff3944b49c9379d0018ae1f4c322014ba3fddf7aff34fe940f818fa081ed5547df292e88737b6e5012a1eaff5471e449bb9d394c809afbad9d3a087d4d108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab73F9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar746B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit