761fc91c56b50f68fc743657e24e647c0180d39cdee1ea4ba0b41a4ee1dfef75

Analysis

max time kernel
7s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b82ecb1ae7354ad53f6c8ea40c3e0578.html
Size

12KB
MD5

b82ecb1ae7354ad53f6c8ea40c3e0578
SHA1

a2653e74acf25cce578cf24c70aea4ca932ca8d6
SHA256

761fc91c56b50f68fc743657e24e647c0180d39cdee1ea4ba0b41a4ee1dfef75
SHA512

1d01e816fd49222a9f66657ece7015b6280aac0e240a22f9459cb9a6b8a8cd52b6e3ec7c3ea6fcafc8c471340bc3d0eb14b9eca8fba13ec38052958e7fbde78d
SSDEEP

384:xy1R1QREDBeVliO/gvU2ee7Io48lX6RTY35wCPRrMO77OM0TCtxYLuZ4mXYHbw9+:xy1R1DeVUOIcz+Io4wV77Ogu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{359620B1-A0EB-11EE-BF73-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2388	2504	iexplore.exe	28
PID 2504 wrote to memory of 2388	2504	iexplore.exe	28
PID 2504 wrote to memory of 2388	2504	iexplore.exe	28
PID 2504 wrote to memory of 2388	2504	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b82ecb1ae7354ad53f6c8ea40c3e0578.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb03e814fdfe9ae51ad2940d7eec3743

SHA1
812424e4c066dbdfac30531d8a0131e38fc9e280

SHA256
23dd9aa6473108928b9505b04df8795e5b1e95c1b168db51ed2eb066a7b2ad9f

SHA512
ec74362f107e92042ecd8d612a3e89d954cfeb22b42d68c5f665a7ec56084e3653d0487d7dae2ce06da954154f288d54590d6edd0f74ddade3d0da2783645e9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d68ee1ac8d2dbeb78e94a811508fd439

SHA1
3e294a721cfca03c3074f732ba537f6f20d77d71

SHA256
bd1e727e6d0f8ec6b569409c1c3abc1bcc62b40c58a1b40026eda08b0635f9f4

SHA512
a9bcf8136757430078f52f0444cce49cb3128bec018fe41f372c7b643b48c9c7954a067bf0419d46af186ed61092e158e44f8033c4b467084f32bbed608bfa2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df2cef2ca0100a584f7d8c74b4d2a9c4

SHA1
8066927735794639360b2a59a3091e55b24caaa1

SHA256
85772de5bdbc1f2af7a113e6781d8cc45306a3046b6e042654cf867dcb6e931d

SHA512
71c7d392a70b44b87f36ed35212caa20aa4847204a6b8587c716a5bf46ece12fcfa95d701abc18a3a673f72c688e3f7cdb380f13e3aad9dc42ef2958028299a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc082939f656ef4b396cf25f723c05c7

SHA1
c400c26d68ad3654f43b6c18eac15c667111a14f

SHA256
53aaf7609fcb4c84f6eacfad9eac9f7dc90e65e4ef73fa467313af30bde12eae

SHA512
2aca851642b9384682898a31cb7fc6c4d9e8a46346d79e1dfe4e90b81002e309750829341039155ac94fef8f5542459ed518d439f319901a55b26deca017bb9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a001f7ce31fd6aed7f4baef088d37b93

SHA1
f46e125977b5373d0e04a858fc948736c74964fe

SHA256
54c869a1de8358979393168d31953b01229d78b1fd5e7df3668246037d4b6139

SHA512
a70844957f65e3679414d95ef242e5897a3be438885f2147ef6b7a26a4b0ae9b938c59897724daa181074fd5851385513252510fd31dfe617a133fb826816d0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d56ce4481a725187d6fcecd3c184881

SHA1
6831ab71c02da90379c82e10c08fbdfe1bdd6dc0

SHA256
6ada192feaf0ec445059626a8edb25cc66ffb9256e9772a73cdfa783e78bd051

SHA512
39567bdef9a0117394537614f1a7cf87d8fad24c90f713dd149ecffaf0cf07bf5de58566388f8a2deda5a1e934bc4ab61e041a8c2a673e8100825f916bedd819

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ffea907588fddd5fb339d661ac08792

SHA1
ce2c434753b85d6fbb00667aa510874085f8fecd

SHA256
9da6651c82d54cd65592c39ed899eb130633b10990144c69719d99ce004cfc80

SHA512
030243f519bbbd7091d7cdc760a7fb158554f34ed7ef7dd41f20f60aae8123f3af7ebd34041d7c13ed39822bf34a57effe4870c131cb4321221fe4c840d284ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b299cdd51bb6cd4fb9be91a7a0966d4e

SHA1
0be4f842577e9c6f86a8ad1c12bea9d1e7224ac5

SHA256
6a346cc70143124b16c83fa1ac387fb74c5aacafe5f27e99c54b9caf6229b2a3

SHA512
df315ad7f63ebf86721760766761b17df67d064714e5ea3ba435e52c888f0a3325012c0255ca847bb21b980005b9247d9b01cce3b3a07ed08a4eea46f7b926e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c5e0733763556835264458587f62f03

SHA1
49341286159999bb20837fd19b09f8e18e4efb00

SHA256
b81c5934c5521a5bca6a1c4dbaf204c74b0ccb9ed0c61be9097a475d8d37fa6c

SHA512
e0ab1bf7f6e3d8607618c79673d52ff10ce918a14ce1349c94a5ab23e56663ccb66b357d823d01ac3c94de8b9ffd86d8eae1b4868f63eadcb6c875131c645dfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19399e94ad4adc87e1741d4335c3d79a

SHA1
3dc6cb1af479e1fd9b77f2137c8f96b21afc4ecd

SHA256
92e998e4e62a32c012acac50039c077660c9facc2d2f4012d4fdda2eb9087036

SHA512
2a0f359e661a7fa3fa01a6c6a523bd49bfb78943b46c0918ecb04eb361c8d86c008da9e0b9b06761612d733c9b552b8f1b73a44775d75b373ccbc0fe7d75f638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45266e1795d3ea4a0d68e5add6fe5cab

SHA1
b2a9f41204ad25c417c944cfc7a085d8eb8935a0

SHA256
b0fbbebeebf4ee725fe29949be355a672b05ecccfd18b0fcccbb1ad657dd2277

SHA512
f1574a9de57267e6e510ad9efa04c5a5a004b636339ead025de15bcdd55ccdf818866f18fbab4e43f9fce219e3c91d8566cdd8c5b0e0d47d33a7eee9e02af95f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de58d269dbd7ccf1bfa3bacb7f440ae2

SHA1
83a41160fc75644dc3af7e72e6bdc7a98d0e23b2

SHA256
d670995f2571e642eef534ae7c1baf09db0f4eba1a3c1347c7d6f8082a6c71e8

SHA512
d3b57237b114b48fad78e1391b5abed0ee39838de8a2a128202bcc84280f805bd88e898f28643b52ae1d9d5ed388fe9bdce385b2575fed0c49f3261c42b15999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a82e3178f2c3afdaeb839cd1ae66000

SHA1
79d30579b170f042dccfaab8edbe5782070397a0

SHA256
669078a5981e2e1c116119f5c207918c92f0369e1b9bed62c8c7479794637d82

SHA512
a34f84d1794f6fe845445fc28fd54b0fc5d54a03b02a83ca7f3b4f665f353560c214b41b6561c22d4a342ff9e56c618411fe0294987335ca0bd2d03c9515a73e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c669b5aa2ca498e7d3e8381331174f6

SHA1
4504f3edab4e04e2f3bd7bfd15308c43ff7d9395

SHA256
30db181bc3564ee97d21bf733a4231cf8cac87391334c0120e48875b57ec7126

SHA512
56179f39a8f1b8cc08241d4a7d0562c47a67f3674ec025a5090ea3818820120b3412a7767af98988ba289b916b742a932f010e49f2bd6a3ab1879b31d882c2c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb4965f3731e316a9d3904f0afbc9e3d

SHA1
c57ba8889dadfb46c218b4b1093669f3d7e20548

SHA256
30868b30888874aeba54e5e67576aef11b82f8e4bbed23c9b44f753a4b44c092

SHA512
d8cb4a144b1bd52be53bacc036e63c230bf3f65bf2bf2b5ea32275ad5a617a6e7a673cee77652e38d36033c8686b7a5d32997bf0b73d1cc716f92fdc8a3159ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
857c09175416a2d847d286851a1a6344

SHA1
1398d558ee0c2391e6abcd54459411ed768d0749

SHA256
6ea877228d32abf8ab609347d34055c9111a9207eb3faca51ac97adcd0dbaaa1

SHA512
fc1ec902f18463002aaa0c5d258fd99af4446d5fffbb66cd08640c098fcaf0fe5634e097c3894d47e3b9f3fc2090233f99e595ea732e0b218b78d9b5bdda1392

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab52D3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5383.tmp

Filesize
35KB

MD5
7e916934b807eeeeebb6b3ba817aa45e

SHA1
bfae634294117bb3bd0b383d5e68fd062134cb8a

SHA256
79241dcca17e64119d9eb72bc5efbecee92f7169b39b6ed5e37dad8a576ff88f

SHA512
5d4f83d4d2e10bf55925ed636dfa40d4400156f28d2e816ca8681a8061e9035936d1c4c2a09f265b84facf26a13de76f1ba0142fa34f43438c95a755b4def945

Download Submit