dd5cf1dfb3803d5f3f8e797d0c0e39cecbd36f5823694c2b6bb254656feec728

Analysis

max time kernel
117s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86e41ac6070809f08471db7fce60f6f3.html
Size

12KB
MD5

86e41ac6070809f08471db7fce60f6f3
SHA1

55559a05441bc936a333b9d190a494f7299b217f
SHA256

dd5cf1dfb3803d5f3f8e797d0c0e39cecbd36f5823694c2b6bb254656feec728
SHA512

215154ffdf6d0c64ccc6c31438f9c813176ad480cdfa38b9ba2dde1c21c59be0cbfafce55fecf67ff308ef618ddf7281b7298151325fe601aa5c758657aca6bf
SSDEEP

192:UhVqp+pBpVNoS96ebVicjWj7qS40lx6jK4kST/0JfJiJJ15JxJC+Sy3iGWvWVadL:Yu6RK3m0lw36BL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412984845"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFBD2CD1-C148-11EE-8C96-56B3956C75C7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3008	iexplore.exe
3008	iexplore.exe
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2828	3008	iexplore.exe	28
PID 3008 wrote to memory of 2828	3008	iexplore.exe	28
PID 3008 wrote to memory of 2828	3008	iexplore.exe	28
PID 3008 wrote to memory of 2828	3008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\86e41ac6070809f08471db7fce60f6f3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a86f6e3a379d72404b19bf26820d243c

SHA1
052ddffb9e9c94f7cec2272c06711bf2a855a443

SHA256
f5266807b292d61a1ce5f4ac1a61f3a6c2bfeaa2706173513e85fa1badcdcfbf

SHA512
7dd2afff5e1130d3fa0b463d3612ab042dfc702699db54190946acb833875cc386d2c822ae7032ed639bc1e5d20c312ea59ef96a61df7bd2a86c37811d6d5f35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13854776d79149c6ab406cbbb12a55da

SHA1
571c718e0eef2934e0851365074dfadef47964f2

SHA256
2088a86d7f373863877c1ba92e18ff570ab15ef84cee5e8f26ef8c509ae25f6c

SHA512
673a6d2ece86e88ab459f70c87e92d88e2f4e0e2a1c4a74629f963eb4e838d97c153c4abd961e1d6c28dddd551d81a72f43f62f61e9ead4279d61d1dfe6b9cd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9504922e2039be76d0e33acdf079741

SHA1
c1a05ab6d5f444b4f9854381fa109cda74c1c74c

SHA256
120b63c3b73f3c3652665aa0e5051a9dc6caf39671e9fe2c9714fbf3bbe39431

SHA512
90da9d07efbbfd22fd2774104cfcafaa3ead480f4595828dda1c6923e1cfc4544b535a76a5121d573943e8642c656e751172c1d72f2120fbe4fc9dbd80f7f2d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
763eea921890c85dbb3459ed19086bde

SHA1
be303ce848ad40b08a5a7203c7ecf893aca7d6a9

SHA256
2687da02e0190765dc1a740374c8f23bd20545c3b236af14147e847ae602afa4

SHA512
6551d752760dbdf009a7e732cd12b9c9962c7a1e7292bd4761049ea9ecf8f23aeca7b6ae579d862dce15a3d45699044fae75a04e17d7d4d4e3b5b6ac3e7bee43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2b49f74b18e2d52a70a6262dd0a8499

SHA1
0a1d340ba62b0de9586ef318cc6faaf4d222e48f

SHA256
3450388531f013cba4a59413af75dc8de49b86786210393467802e9efa402342

SHA512
b0411f9eec9bed27ba6c5ba4075421ee3f575fafa5f96b60821d22d4623b3159c864d707f087d8f0d1faa6c0c09d5637f90c512fd462cf6de44c886b06b6ec09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e458c17098798b47e05299f29b692707

SHA1
557fadf54bc2d420e75e7e194b51d9084642ab61

SHA256
d83b09a8e48f81945d84abe48363b0cbc4668211b54a36fc269c10ee00708d70

SHA512
418ed4633e3fa25009c0085fd117895838ff71c1a8353f46b1ccc488c8c009547ee6c81b4dbfcf6ae8a81d9a902faf413e2b85a07e18c59432c245e6470b66ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09982aa94f7ef9df2a0eafdc581c3391

SHA1
3749b56c6082886e8243d5326cd25b4cdf279609

SHA256
0dd781a1265595d2b8e7f37675e63dc3116314ed1a79d779e662a7298ed06f30

SHA512
57e3f73ea2004f848e27b951a3e70ff8a3984135d7128127104d34a53658455c7ec0e7b5caa805768c799d7bd5a13f0a2044d4fc77261dc70b2662535d7b52b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09dd913a657f8c414bfed9fe8e6cbff3

SHA1
276cc89819661bf8cf820fc901e49b6a9489fcc4

SHA256
82ccf016cf2067f915469cc4ff70d9e74320d125c598b6687728c5bd15dddbc1

SHA512
cd419d28a3256c8d700afaf0e9db064312480830cb72657f80babf88d6744ca9f05d5f31beee9885b0ec44a6491d93c5b0052ee07ae4c9d74a95dabf11f52cb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2b55f73b39b4b3bb3bd94febf125b92

SHA1
1faf2b903bad262093290459105f7a0c2e230cdc

SHA256
4e2ccb877dd4646332cf5ca3221a44e5375de20aac1008feb57c2ebc027c3cd6

SHA512
08fde446b6ab5735963cc3011db4eba536e061e3da3a01d1dec14a3490ded4616b1a6218790f641d08eb871ae4e5d70c78162ddec6118e38ac2bc9b455383171

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f209b70d5f3239568e7aab060c4e14bf

SHA1
d90d71c62b5ddffe98f90f34e784a4056898998c

SHA256
d9f387f58032b1da9d1ec2994fa6f288dd25a2943838cb54bca4b181f19891c2

SHA512
9df71b15928ccb5ff233ccbaaa332d38b48e6fc772a1c2f34e1d233ebf313098bc70ddc0f92812336fed1f6b4162d0fa1fa410bea5a4aff350d7f7aaa91e2945

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad44e3f94598f36a88d3493c20855982

SHA1
2973b804fc05f4cc35bd061135c39a245f5c1453

SHA256
99524130dbe858376e26115215a9a08212b821095a83e13ae8c9008d77eace3f

SHA512
2650751d7c4e46f5b1d12fdd83c0f16f9dfc63d710a15c053b74abaf46864a81b823d9cd08e5b169b2ec80c1d227c5271ef32129d2ae735a0e8e5f14b998c2cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a45c540e496f76406f8814d9a62fa814

SHA1
19b3cd59a5f53695a6a838948ece68839e8e833b

SHA256
0c554a702eb52a176f23b97ce142d2c7e0391502617b4d78cff3fec57d65db1a

SHA512
a3c0471882aa5c2dc47d65ab5c1db429141b9ac4f6405b40358b1b2850787a74ca50662423ab14ae74664311d31855606dc2ea0e1a071bdb94f2180c29f08d45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3897bc38236ad762b64383d0d7c2afc3

SHA1
7253cf5a9357bcc2dce238e2aefb259b7dd11d92

SHA256
f68a0120904efc91733045aad026bbaefec2e2066577e452881cf81f7ca0a291

SHA512
5dfb64ca884d3e117bc7d655946e042662c4f54e53b3676c02d4aefd9658cbe2f570347463f16b0dad159add4c96bb665807e772568a36d3157a56d28ac62c13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
faf9c0ab408a03a798ceff1db8f1afcc

SHA1
1a397c623c1c8b9149d808b48ac3f1b9c763a973

SHA256
4fa3d61344c6c90a22468ace99567008153ed6c3cca6740712d818aaa5408feb

SHA512
e0fb221dec5375bbf031a956dc69e2395e278c214ed9c164e63f7f4267141e8c2fcb1028c95424f088a0b1b62de6f248cf50b2732e6d897df36e2e07a7da0738

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6AB7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6AB8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit