32752dc2f0995bd20bed20470988448b7e050d73d1cd87a3dffc56708640b1cc

Analysis

max time kernel
122s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 22:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

87c6b9a73672de83b7dff709a2f82c3f.html
Size

2KB
MD5

87c6b9a73672de83b7dff709a2f82c3f
SHA1

f76dcd753dc4fc1c07ec54aaf3196de96716fff3
SHA256

32752dc2f0995bd20bed20470988448b7e050d73d1cd87a3dffc56708640b1cc
SHA512

8818869471c6246f0d36949c51dd65b1243084bca852bca3be07898769666629e3474e5c4747e7907941791b1c17084f7e30654666372079afd65e4ea1c990b6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000dd9dd1c75126b727f4176c97abf140c661ad6b05348d158e5cdb464d8398d69f000000000e8000000002000020000000f41f01aff01a26f98a48f5453654126665d5abd729e67c74e44bba68b8456acb2000000074a98c651237b9dcd2b6ce9fcd4dcb3f47616792934b8f172416bf643ff67a38400000007504203e4167a843e3c3bb1a68f33e38091419f6bfa6807fcdf139a67cb519e60ef05d514cfb04572886d18a2dbcefc09b8962f1cb2e090d11604af5e30f2a53	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1949E01-C14D-11EE-9F40-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000085b0a25333ae96c90dd254329b9a018bd58a57bce134ffe34c1babe81f0807a000000000e8000000002000020000000814ee82b5691c0b833e16deae409b2942cafd2028b091a489684c54eb8a653ed900000009d6b7b26de3301908df9899965c66574a1642cc045b0a3365113917ed10af170a696d43333749a600d42572af69f97379e94b734243d51230bc6f6fbcdefc88b4107a87285a4d4480bfaca1be93db96c23128f44d8a33decbda3db9b5d7b77888fb796ebfb3406491151b623691339410d3dca4a96e62ce118062e2540b3228b069f35fe992b1f7a9394f9347cc9f9d7400000005f36aef8d64d6ae46bfc61ecdbcc0922587c6b21890bedef2dad651234bde87bc3cf1813b35c055c212339645db3cb5303929162027bf901ffe34064cbb374a5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412986943"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1032edbc5a55da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2944	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2944	iexplore.exe
2944	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2760	2944	iexplore.exe	28
PID 2944 wrote to memory of 2760	2944	iexplore.exe	28
PID 2944 wrote to memory of 2760	2944	iexplore.exe	28
PID 2944 wrote to memory of 2760	2944	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\87c6b9a73672de83b7dff709a2f82c3f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d8ae462fd4ce13a567f0b6b1c0072b1

SHA1
8e1a320124320f149e38d8d1635dc57263e57d6a

SHA256
5be73e50d7fc8d91daded5364263fe199fefa33d462e84d5dec6f6b14005cceb

SHA512
e7a3cc8b66c065a5087550844e152c5f538dd02717bead2a4967385c04a409c28320642723cfc05da477ce4d4d4cf3ff516ab9ebde12ad7d609a75a385d932f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa7d09df31963421749d547069f69701

SHA1
7435787c8ae6d564931f5a40dc3882fe5f0063ed

SHA256
c798d50688de53ce9fbc436f903f608d7220aee6c5ce31c10dd3b8fa7b9e4251

SHA512
8838e076b2d47362e646768602daac38755daaf5e4d67475f894dbe6e317b4c524eb32c795fa149715d0a9414707f49fb92fcbe89a434ab3414364f06c74dc9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bda6e82b81a253631e2b0e8d8f8df826

SHA1
26390a389a0bedfbd05d2509356496a001910c44

SHA256
1f0624a503e200aff74b761a3da06f37d5172cfeefa9a07f61af28d158823cb0

SHA512
be4d7fbdce321df5b7b56dc93324f1adde715ded8007a558fb27c2a57dbc690f78227365c094ad2338d03c327cdb17c6701fd8a518c6fc3fd36d7ceae4dc4994

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d34b3353d39d6cdc32b6dc910ea9feb

SHA1
d4926eced77fbec8742a4d76812fc6b07b18c946

SHA256
210a26af4f8724c913abda2aacc51e6600ceee9e7ffd3f669ef8285e3edd2a5e

SHA512
4a6e63cbf4f33ff71b48a13f5a262ca875f5c325ecee182f41d1a8b3fd9d8522680c02d072d86b2e92fe55a3c1194ce3977d5e73fd7922e075f9ffceb606434c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e863e4354a3b938dde1fe5cc00aafd56

SHA1
188c9536c789fce3a9aeedada7f35ab6dbe0dcba

SHA256
cfef979484731dbb41a3df95df142b99575eb784500d7ca48d285b987005d4c9

SHA512
8da5469f807b17e0b3964168ba5409c988a2c54ee5e82cc32595b47fa5eab6e230c85a998d33e64e03f942cf6de4ff2e60e33f53783cbbe4185524c1e57a541a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e9a47ad8a28b0c7f366ead6ae5387e1

SHA1
34fd63244a8370bea6b776f63c140aeb431efe61

SHA256
c515ce360f5ed99caad4c7febd3ddfded1cf81d855c704d4a00f153e79095f7e

SHA512
2bccd9c2c45b0b7d0236c72454c3d6e42a528a543d69f511ee40015e5db95140b500e3a7b6973a3fb6687d60d5f0c19801a73a29b322bec75062c6b4166f0c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
956d30df6f36841910c5b96b269c235d

SHA1
47fc2b1a7921be16b329b9f11dabac3934d9cc43

SHA256
d3e61023197947cd16e116597b63b74b935bda5d43d6f619fbb8b0747b0842ee

SHA512
79c1170e1a0ab31c571783650eb16429ba073886dc98b72ff328e36e8f8818ba45ec0d5bdb9c33f46c17219fc83c086f690864fbc36f629e778c67202a3a84e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
640a3dd3cab9edb071318a27320335ee

SHA1
ddd450d6aa8c6c70ee7e5fe0fc90e1c222c5dbac

SHA256
e6132c3d14aab4bff7a2461ab6132c92bb0063201141169ca71699adf06c7d6f

SHA512
85e9f2bd48fc9296f70084a96ef4692b8ed4e16d9a951c37de6fd17e1fb9853746363e7092fa7f586c51b7355645e85439a0017ad4cb14c997665ae150b4cabf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4ea8b1dbb50a23fc3e12a46ba4e9b8e

SHA1
dbf1e1247fcf7c8b9bd702fa89385185d9f7072e

SHA256
b6a4995c0361745ef14ad2058f0823a26546c2017d619f48fe52f4fe806dce41

SHA512
c18d76e04b528277ed01e53cdf76e96f5b3b61f465fa2841a46c255d36f59ab48988613bb4d1f70ef5017145abc063583aa5a7812aaf734ba6f0e48eb66532e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a15909caa8c9e5f9a72981f7172cc1b2

SHA1
10f39c8ea94d301b52da3aca18adfc7ecfaabff4

SHA256
89f4a0857c069b68c533e062d0dde3766da05a3759cf9d8c0409a2a87223447d

SHA512
0ec18ff9bdb9afc80921b85a02f5ede04e30c676d6def7bbe80cfe0e2d1045059bb5c7d748ecb152a37cc7a7d5f608d2d9b080e00d3466d2138409a0ba598b83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f736f31f4175ea7a8c02e0634c22490d

SHA1
6732f5185068181dd57aaa7689c1bcda55d3d58c

SHA256
f7898654777ad0027bde6194e35598ffe114104b855118cb1973c7df3dc004d7

SHA512
fe75e3657fcff1cb65efb460ce9d738affb6a5a7bd5f71d39ac82cc7a69a2dc4cc33e05a27891aac32892f03df5f430393e68a175f5adfa7eb1548dcc5b5b901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fe553dcc6ad04ed6a46e1c465f1ff5d

SHA1
925147f43a8bac1073da2528739ec5a148f0f9f1

SHA256
6e44aa091cf16dedbdd5468eb19ab488cd7f1df2bd64fdb92702eed18201b72c

SHA512
478d1242655d2d0f0e0faf5fec174f658fddf60f4e5e37187fda9c30184fdaf134fd2cbf266791ef3cca332c856219cd63089026a773e7555fb6f6d046cb2ac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f995d113d3639c98528e0e01e7d444d2

SHA1
cf44889e1410cee17c9d1a27e4bda8ed587bca2e

SHA256
bd0eb9068256431db1248d6edfc53f20ba8e8f4903ef88af6852978796ff208f

SHA512
40293456846e286995f2be315286f5366549eb523b043aa6de4c890262a25b95f4b453f541a0b77cbafa07462ec452c1f86c4ca63bd2f1ed26d5af519fe14618

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e67c679b16351314ade01046261894fc

SHA1
46c012ba654588ad3fc3fcf993c5b5aea8596b46

SHA256
bc2be6287409931c8c943fc801bfe50ef9e4e9a732562994fea3f4a31ad279fd

SHA512
5b923d3447d7e09317bcaccf518e80a347e41620d939cd7e25d84082bfe08dd00b522778deb91f321758abf3fcdfccc0d46e9368c73f65b3a1b3140feb13b320

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c82df61eddc259f5298fd3521f6c5bbe

SHA1
1577d8e7a7e0ee612df10265c736abba6219607e

SHA256
caa3a7a9f2c21876febfefd618ff3136ccb3722fd57d99f3cb3c174c8466bf93

SHA512
0ae109dd47a7237f2480f01483edeb329031f65a4898f64f5090855ce7ed3717394c1c95ac81cff604c59617c82dcbc614ba2874e6921b8d5732ddc5ce592aa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCCF2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCE6C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit