b1dc782f624d9b45b034e3d385ab03c6b26993fe42b1c6f973d146f6d6afcbca

Analysis

max time kernel
137s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

59a24cf65a27cb3c8b9c38815c3eaf79.html
Size

12KB
MD5

59a24cf65a27cb3c8b9c38815c3eaf79
SHA1

dbc8adc460f936f4dd303215765110cdc53d2568
SHA256

b1dc782f624d9b45b034e3d385ab03c6b26993fe42b1c6f973d146f6d6afcbca
SHA512

c3b4ab88256e8a46fa4555619386b9f7ad29c1a4a96952652236066a449b5234db1528bbfd41943bf9c0125e2b25804e9d4256616249d3b5381948052c5a5195
SSDEEP

384:xy1R1QREDBeVliOHcvU2ee7Io48dXbR6Y35pCPRrMO77OM0TCtxYLuZ4mXYHbw9d:xy1R1DeVUO8cz+Io4lV77Osr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD7BA1D1-A15E-11EE-B84A-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000f860bb0990a36d622a3766e10d45245e68982bace8c23cf46d76c377823e5cc2000000000e800000000200002000000024cbd69d1d58e458365e787f27deccdc9422d60d09bd8c4c115178f74222fa9a2000000062228890970aa5efe787c2a16f4b17c37bcc9b6595d79c748bc1c1db2b676f5940000000f209af134e2cb657f50070d2831244d88b99dd7ce3a582067d8b11b288362df91d59c49eaf760aaa259581cbb6039e0a7fed8ee45f91784f0ff4258b37dcd1cf	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409475748"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000052b52045a136433d4a7e66544b1a7f8db31a016665ca03792f8d7b18725558cf000000000e800000000200002000000041853cdd027f6b2d8876ab9034eb66c6dc07c0399f3c5aa81b8d323087a49aad900000004e3c8f5f8ffa39e652818ca9788cc7b3858c7cc3889cf6188b903243db3b73c489c63e6daa089c241d3a78ed186c3e0c7fd208f7d03f5ab3e04d2d41538804dc09ebb716b7969e66a94c0bc5256ef7919211ddb4606d9ea742f50d699f2c8467f21b29b3986c20f2897b451285a5a125b0b21fa66945e4963f6afbbc8b8f29cfa9d725917f81cf4687a2fd7685a72be84000000053069f9d05e5b596f08632a733b092d0b18990f4fe20ad72e0d2eea34b879f648937fe613bcd686fb2f9c98fb5773d3e7909d7ad749501939dee5cd12b6860c1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403efa916b35da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2344	1732	iexplore.exe	28
PID 1732 wrote to memory of 2344	1732	iexplore.exe	28
PID 1732 wrote to memory of 2344	1732	iexplore.exe	28
PID 1732 wrote to memory of 2344	1732	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\59a24cf65a27cb3c8b9c38815c3eaf79.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
291226dedc9e550cce8de34120625d0f

SHA1
51381d37de02259537885d816cf5f01460c5d5e9

SHA256
7720b389bfc8486d679ae763767f9a66c57bc88aa1b11d3bbec2e2840ae9dabd

SHA512
77dbd0a861b237cac4c596e5560af9a7e9b4ae56ee18029d081f9c530898b3ab42e9c2c19cee313cf904fff3eb4145e27625123369e99c9b09331e9b7f281fe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cce076c11178d411395b228b46a049f1

SHA1
0689b5cf78934978c36abbb8a99643f22ce4ebd1

SHA256
8d0bb9161ce7b53236539eabb5b2138d484ee9d6f58443ad3883cfe1f57011fd

SHA512
f096334e933ea5ff9f23661ade6a2d327173e49f3b2ea19e2f9e8badaa2ffa778969ec08df3c4a4204f21c135a50832678d24def1c253db18f5903e1e479ffbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08378d7204e27b53607f26ca5e223257

SHA1
85d90343efa135c646adeb348bd4de6e42e3201a

SHA256
d2cc5398b7b7161b58ee8d49c12a57145763836ac99a9b8d43001a80a303e1e3

SHA512
275e80f7f5d124edfacd17c5f86ed8f4487df58a570fe54d58aeb53d0ed66e74bb27dc563a64b08e019a06db87db22c4e6daac98be95d6d444173283998ec8cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
992368b4ad298161ca5b4fe2ff051252

SHA1
4e3adafdcbc19a276dd38e34d2310e903f7eb014

SHA256
2e68ddbffe9994121de25a5735a2487bf7832d267185740bf9581249d1b58ecf

SHA512
d12cf3c42f7c65d285337f570cf4638d093239bee8fb121ee8272582ccbe3f75280ee7c6348bb08da2252c441cd1d245bb441daff19f2c601ba25035fee7fade

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70780a46023f023634db4af037fc8de6

SHA1
8f8319ab0775029b2b1acc8ffef6de090717702a

SHA256
54749f6c7db8dfda48afba9e3356ccf917e48b4f39938be332f3a497a602cefc

SHA512
d2a5c19890a50e1136869265128d0e777e7ed8527048b669a586a0f689e5b689b8a66ae0cd3188d7ff263d5c5a23d56e65b1c79cbc24bd031614eba1e581de37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4d4e4dbe28f181b3b78acbf0bd6b498

SHA1
e8be3e7912154d01209d5f0726c451c7039b6888

SHA256
b2de992f14ad3f348adaef2fee19db015a08a9d70607c7eef77c7e807a31d7b3

SHA512
0e97e19ab872ee2cb9707e23ffa413357925e85144c76d23c4b33acb016975e71b2f73592a5f5da5b3e2f3a002dd2057074c68727c31f37c063c8acc3b48745c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1c524a52123cc2ce745c55cc01143fe

SHA1
70d9a257a457f39f97d7952d715d434f2d4844f5

SHA256
04bfe5a4244b3c5767190fc4dfa32b9288cfc09bb2ae67e2ef1b8eea9a13728b

SHA512
8d6085c22a6ccb70e396196ab3c172082c13ffec798fb375fabc48aa904e92e4d197a0d10fc93ea04abd46ae68988d67bbcf6b98669128be23193cfbf921a359

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7892a76b84c86cc75036285b048f1947

SHA1
face9d5181a08be9e1dff8b4889c72ab780cc9eb

SHA256
b8ae7fb067235003d96b544fb4282cff1016e0dc4f5706e596423053fd6a3419

SHA512
5dc4cd5278225d7a9311e1cb81d9a9b24947f6ea7d864078c8851dc601198eb63b09c301180e8000ab74464d7cc8f66a73b88e72011ff4e1bae139bf274744fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d47efe2187a10ff734b09a9be8e7baf3

SHA1
46d09d787589f3cf91b694cf04ab77c9e778270b

SHA256
b5677dc9905ec162424b9397d89785ae3496090d68fa1bb177673285ced7a6ef

SHA512
617d2b37a681f2cbb308eb283e468ab5825c530b7fb11a64ecab1ace30ac1910895b3c2f1ade3a084f323b036845ce79faa04f25ef001a916e8d3b99c262a6e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea07806fa3c6c299c666077b32180f99

SHA1
10f96106a61e4e2743577fac004ff04871323bea

SHA256
059fea06362e6278a9ac47ce54c96d50979239308501a493bbab08e0d7e32293

SHA512
2d63ef409d838e4335f4414e6fe89681e825b46b987ec35bed025fb6b552eab559dda053e319c39234b553354129da9934d40eaa7071339d67985f52fddf0925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54f2aec04c0feb87e6ad5660aa04f89c

SHA1
49297d0a3bdbe281b7ae034b43d03a9a8608e10b

SHA256
197f9512970bab86fc52ce93e268d4b612d206eec5a8585cd1118d2010c0b713

SHA512
e3d91aa239334abf5c981bc2d8e84444e688864cd60a44d15d54c99a0459e083b29e86cda1249586ff3f5383dbe1cb8786fcec201fdd05b753a5e1e19efda3d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d510ee940ba08bcdedb7199e719e9c6

SHA1
ddedf2fe66a2cc77bac63f1f43d0f865a69a935d

SHA256
3b5cb24d50ccff90889a4976bdf5300ee6efba8db9e3f6b13249d3208cb923e2

SHA512
7cbe3dd4fe5be8b5e8138ee3f117834451a86353ed45150af6503faa4b1cb718d9c45c49298d348bba2107f62201d2011a6f110a46e78cd838ed736788446218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f1706b8f25a83a329768977e438a014

SHA1
c18b39ccd8d2d60016599a3b462ffc09b4d1a534

SHA256
3db5e8e1e837621c1b60bea80caead4d734fa15c82138322724865de2a112893

SHA512
4c5fe65232ee93447207a58b81007118528ad27103be257ffd41839075b1d77ceeeaefea4514f44b1a2c1061dd81d06fa02b1ed7236b2d2939a2955d1a1520e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aac5ea9c22d91fcb562ce7826010170e

SHA1
198ef70afadc7a590e94b487361f4d1bb8700c6e

SHA256
086ad15fd3881166d6d4629f391b191ab14d87fac5e8901e5a0644a9a491a800

SHA512
478ed2b30158c477c6ac0dcc2561bd46082b4cce7bd40c3e84a541e3f60168139839b52390ccc09c509f41435efdab609be3112879fc95ed682859e0238359be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34E7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3672.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit