dc786937c370552c9ade0058ceda0ad17c29e372f9e981e0ad7f8ad82bf5a974

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e1e1c7d20dc6ae72d77801e1ef96ac34.html
Size

80KB
MD5

e1e1c7d20dc6ae72d77801e1ef96ac34
SHA1

6841b374b7e1f5dd4bbb5b846fbe1e0e09455dc1
SHA256

dc786937c370552c9ade0058ceda0ad17c29e372f9e981e0ad7f8ad82bf5a974
SHA512

25748fe82bf03adf52276841728cb19b93a1712878ffcb2ae0a03cc7d9b5197a5e0a9bef513d9fc0094ddf4c9b52dade384caafdba8ea5ba3e52622140467548
SSDEEP

1536:BvZjInh3fyjM/TA4tX+L0vygEYD0ghNxgefN3MU39DMgeNJf+wJS:RZYh5T9kgEYogeefR9DqPJS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409440195"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506c40d41835da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E37EEB11-A10B-11EE-9853-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b352744dca058af2e7eeee46086799a128748eabfa8263c3b9065d21ffcd2a1a000000000e8000000002000020000000bbced30e2321d26f350caf017a4a1164ec1420f125b6e2058ac7ff5a2b96bdb3200000001bfa954a058aff12721bc811312d418fa7b2f35ebe0d4321592c8048c0104ea940000000bbad42e31c32a16ad3a5f5b69d1e9a7444525050d1f67d5832e877e4e2e1315aa4c217a027dbd09bbe90dfbe719fd940ced111387c746fc0436f490603658803	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000cee746ee11bb6f90c56524a01569dadcdf98a125fada179ab1d986ebf046dfbd000000000e8000000002000020000000432ae70ca16b1a664dea524d4f31255988c994471478f0e1bce40e8585c1c23c900000008bcf47cc5bff38f948292166c9ad7453494dfb22921ab3f53f49a83d7aa05ffb56cfeb11172f855e38fbb347aa5507cc66f3704c9337ebe9099fe446dd0af85df29afcdfc34f5b2d3d8798717f8324918f60449e863eecddb40ad846f2a7d1987c32bdf7330566feba456540025712f50b613738c3716890702344ac6479db9899a46f5912aa6e1c492e8b5da5e7b95a400000006c63d3386636d7678d9b7230486c2a831885e8772e7d8a89504a0c113b54aff32f3348c9e780b7f08bfc723607c573448c0a1f2c23161099e427a61f5880f7e2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1976	iexplore.exe
1976	iexplore.exe
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2756	1976	iexplore.exe	28
PID 1976 wrote to memory of 2756	1976	iexplore.exe	28
PID 1976 wrote to memory of 2756	1976	iexplore.exe	28
PID 1976 wrote to memory of 2756	1976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e1e1c7d20dc6ae72d77801e1ef96ac34.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56914d6558a5ab5b721c87dac11ec87a

SHA1
cbeac3ccbab9db2229638d4e5b8ee598582e2acb

SHA256
f1e449498b76424a3a7ed57a8f94a988a2e8e2eb7276db047e6e32f843ee3220

SHA512
3f3fd27ef5a3b377c0a37536a2375f7cb8fbdb639f1273466ed180d45113dea1ab65e55c530bbf76b76f35d539fba04769be41a6573688b9dfeac7fb3617bd99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8cf809347846ab3acd48107fef4d05b

SHA1
cc8a1dcac6f634443e1b00c6ff39bf7adb24d866

SHA256
f954e574c53bfdc2d781fbccee872ac16e42a50339abeaffe956ef85ca9e55a0

SHA512
6dbb7948823ffe69389cb330a245a4e9cee16d1d10ee36ba25deb5f03b27785a0bff3a14310ddf22e4f0daa4bda8170e4d7023eae710c2b02bfdda23d6c6f93c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c41cf7b3ceb4809ab3cfbb5fce47b67

SHA1
04dd72f02aeb343b9281cb00f546a208247b9640

SHA256
6c637f0ffc24112a148bce5e511a12adb0b1886590cc2bd7a9ac4252ccc2d464

SHA512
4fe64354099707931a7e2e9cedd3d2c031595ccb29a6729fb2865242fe4ab36dbddeff3a3475d5725daaf99bda5910ece6484062f7931ac83e21d0b915120d6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca519766029e1e3528a30ff18a0e9429

SHA1
8327a648e40d1c95fed16c1e396b22bbd76f311d

SHA256
f6ec77f31f7c16ce63510e14dea35b5dd21c118d1742796af2758621a0fd5612

SHA512
f31328b0641c7d104245a274063422bf6915e2ad338e46c5455610dbd79274bb6ee27104229bcf7a75f64a77ade387c6520cb7f8994e6b55b539592388678350

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aad69974ce58419c87c129e4bef62d94

SHA1
2876b5a1509a1ea2d01d9665c19ac7c53ecc77ca

SHA256
b4b3dc6040f9ae139d483e79a1f6df4b5c70a1c2f7b8299cb12aa9894cbf62a5

SHA512
734264971983a64d66192aa419225f85e3c4ae9dfffa1dbe09dace4940d331351656f85702106c5e5f11862592fbfb2d4ba5c29acc3358ebf8c009f00552d8da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b3f610606286c4705a6b1882da55f62

SHA1
4857fa05145a61ee1633b297d50324cdfc809a99

SHA256
d04d6d1dd6312353565926db047ebbd34d4cc510dd418df16a8d2887d38042fc

SHA512
c299f0cf2a6580e3ee03d50e502dce32a0d2a8dc449303b8bc7763bea78be10a58658e880e89aa51dd602fbb06a84e91ef1cc6143fe77dac00dc3aa8ea12b438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fcead401e7f94a9e3f3eda0bd4ca069

SHA1
78ee232ef72f1025fddd1ddfdc104f2333a6a6d3

SHA256
3d97a73a55bded6c32b34c9b6039e2d53464b20641a82945af04b5dcd2b72a13

SHA512
99f88b5968bff1f4b049971ff32b8e22758ba014d0ccc0150d354af4a9f7684b3753804bcf90d1345bc6a1f3c29636fa4c2649e436f2b3f1e743f0fb40d5c91c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03d478e8a13bb717be4bba62cdb33c8f

SHA1
8816377da992efc89036296acf9e08ae31ace120

SHA256
69185dd3539507fc7a7c6ff51cd22d55b675bbc7682e2e92ee06fd51a144f6b5

SHA512
0c3a18239db4eff05fe26649b0efef7bf4eb3e170d1343601fa5381e830be692df69e591bcb5af360a59916ec262f22fda7176da99ec395c585de71678249f39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82c329ec45b22a7486f3d952488bd9c6

SHA1
a012c1f8834c19dff40fef82321f372aaa07418d

SHA256
2e135d0fd9e09991325388442293fa6a3e79cf50e357b1e31483564a4e21473b

SHA512
ee24dcec1f294c5ec7f1abc02e62047e2dc878d8c30185c824626b6e1f129cbbb0d4dcb24b70fa6b537975af7dbd9eadbaa988cb1738e4aa4cb01cc7488cf317

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c0a6ce1a3b18c14ded0ed866447c1d0

SHA1
f5aebf1c1c6b286735703adb0e9d21e67f28e0f2

SHA256
c3b6c737b0927d8463811a1bb2cdd4d0cb2cf8da177ad7448b23bfe2b518bc67

SHA512
22dad421ba98728c95b42df0b8111bbaf90b726aa385340e916b8951bff8b3eb450848062f6972f0a433801739cc9eb6ebd174c55641444759a62c91a3b12e52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d836eaccbcd9b7d1b57746488dfb4b9

SHA1
e6a651c630a83062c5de6977f50f890f61c475e2

SHA256
635c0a57beff5721e418fc5cf574db60b13249e96be0a1960d6086291a58100d

SHA512
8d7a77ca937223d1f70cbb39e0c7547fab3b59b2216dacfa0bd7990947c1d744d7516fa9a04a09bce330eaabfeecb728e39dff2d7d5e3b81456a34b0d8ba3dbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6220d2eb4c62777a09c606b052975366

SHA1
50a2d7f5b1593bfdf5ff60f8e4bdcf0db5d777a7

SHA256
93f5165a68e697feb7e806aa2a3927f956f3f6a9bcb144a4f12ad03df5b5f3f8

SHA512
edb0674b185b1ad8cf2dd0cb6e11f21644cc85c84ff958fcfa7f1c47051caf35a88f2c72723b83d301362135aebe0ed1b62b4edbe8ed78d5d5fd94061b033c03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ec481bff67c8d82d9fcc13c63f69762

SHA1
17603ba5a0498f56098d4d7a2859de88c2d1935f

SHA256
1aca5700f8b523f397b1d60931446d827dbc9a2cb4021a92a17a0ce332b8185d

SHA512
8ba3044db0cb4bcc479daef4116c663fc7ade8e7b86dc147b2c8d60502420faa73c269f14a6edc1c2c12724d94f412d802668df495d5fc15e1b270070365ef1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25767994dffd33f31d71ee59af2e02a6

SHA1
00b526ef0a89154e5e0621f38f1388846731d4e9

SHA256
7a6eaa59dac0f381ae910abbced0f9a52820af8db27702a03fc85a395fb221c1

SHA512
fccfb6b6a31227fa12c8d8c1972e5284b59d536fb3f657fdd4b3952692f01d40b130f5eb993c460a09e26f0c2851a469793d4e8eead0d1a234efdb7ae840efc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b511ce174fcee083cc6fa3f0e8f8cc8

SHA1
643a27c30114e20bdfc794bc4b1f8f70672b91a3

SHA256
f2e2095151180cec866d3c67c2f2b1d4bcf34949b1fc5b868049242b7b0b345e

SHA512
7a9b551825e26d53b654ded682989b381c8b734c8e285e5d96406be5bafae7e49156ecc6043a54db9955da554c42c5d8cfabdcfdd5cd1cc3116a9879d4614026

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9511cc8c28e5ec568e6b4cdb1af4c82

SHA1
4647299860f7a2d92af79339dac876d8b3c19225

SHA256
38d2c7e90093988a1992fcf682b53827792ebfc1b9b18f37a3d8676a5c8cc3c1

SHA512
347f4e2b219bf7156930ff0608ca47bee75d3f41e04e91271fd260d509bf66eeb7c078e09859f88693baae6f53bcfad6107113b6ff2f728fa8d4b6b403cbbd47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2945a023f94772ab31d1594585f15b7

SHA1
ceeadfcc2c1ec71edae67feaa6cc97e350db5337

SHA256
29352ad4e4294a8c729c035627e506155c613412a23a1cf501fe2165238a2537

SHA512
20012c5a112b2e45ab6a65de929714e559451db66b99dbc6776c5407d6be38f993ee4582f8e5c663ac54763909d6990e906920edb0fbf18ab52697446ac2c624

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA5D3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA6FE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit