88a78d5a21df3d52e15d6f88a340dcff7a1c34db010428b50b5518af6661fc81

Analysis

max time kernel
132s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5d541bbec33900f562585e3436eeb84.html
Size

16KB
MD5

f5d541bbec33900f562585e3436eeb84
SHA1

c04c35127595577720af5a9852c8a0adc7163286
SHA256

88a78d5a21df3d52e15d6f88a340dcff7a1c34db010428b50b5518af6661fc81
SHA512

76a71693639f4674d382ba6a6cfc6c9f8ea0f873e0f7c37968729262a8df2f71383455fabbe566790b90405b20d2e267f4f2bba775ddd15bfd25f524fd279ed3
SSDEEP

384:SeNArFAJH1a3aEduZWx8+AzaCaEdPeBrOMOsuNmC4:SpFQVmd4Wi+1EMOs2mp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{246A9741-A22F-11EE-B16C-EE5B2FF970AA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10fabf003c36da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000006b40532eaedbf373dce645160bdf6e6832657463337772b245db35569afbfe2c000000000e80000000020000200000002a5bf9b7822dda3623af51a13f8ea5db191547488966c02af9c6088ad3eac60920000000f09d040e6ec4c91a46924f9de59166b117228ceaf8092c25bbf5f7b97035e76240000000d4c689dba880ae77e1df7d5b2c8eb4c2deb222e41e878bf7bb2407550e3a1bbb9234f1874d4a0981768e9a6a6948167736d190c5d0f5fdd3190e78f3078c3730	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000004b5b85760140342d50ec18542a440f9f47d1ee5a505923669676abe400d46294000000000e800000000200002000000069290538eed448743373fe9d2731dc9af8f00698170066b7402c8c931d96f4f890000000d0a3e5d7cb9c815898992a72a32b58cf309952be74abdb38e25536bd8abc7df50d5940b3b6335b046729171e25c82dc0ba9c2a90336bd3b11b02e331a8e8b3f5439026c7f9177ee9337e679db0cc09c63cdedbd09956d9fc0ecb0031f99e617f1ad9f650596112806778175a76c858abf1f6d8589d9a711dec8a71736fe308a7285556f715700b55bb25dc00da63f9b1400000007e781ee224332c625c410ac4e76a81f32778f9ad7f5aa4279908015ab6cdddc38f2054ede15be9345d4c30f3ab6827f1890faaa359a391d5ad217b9e64d16567	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409565255"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1232	iexplore.exe
1232	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2984	1232	iexplore.exe	28
PID 1232 wrote to memory of 2984	1232	iexplore.exe	28
PID 1232 wrote to memory of 2984	1232	iexplore.exe	28
PID 1232 wrote to memory of 2984	1232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f5d541bbec33900f562585e3436eeb84.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9915FBCE5ECE56452A09FB65EDE2FAD2_FECD5AAF1BD785DC5D270ED705499139

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_D93C575AD9E9AF9B95268A3CB953B5A1

Filesize
471B

MD5
e0400862e445f3283529bc4564cfe511

SHA1
610fd285ed4097bb93b4126e1d61e6b8e4574c28

SHA256
19055bdbd8ce123d7c3c1e39f8e9bcd920136a45d6a02c38fd9bba34294e097a

SHA512
0639b1c2de12343ccf7a1c9c37b9e06bf0f849701a3cd179f3627be8ee544cd0b9421990782c492082caa4a9110748317c056fd68495ea5061215fbd0366f938

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83e7ba6a276d83dc489f5dfc219795a4

SHA1
b72f59299d1e034a323eeea8a036c7074345dbbf

SHA256
76f5cc31fa83e569f971a0e2df705c91e3d53d3e09c7f6f75ce9eebaca457dd2

SHA512
ba857e5e49a7278ccf3da691128307b5e42f07518893da9e56bf28e4099e3c25b8b2640160a7c8d07ef4e932d04b84958d13e55cc49ca31471f5ca80941c69e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26fb67760f81ee1a954f6e5dbb5d9811

SHA1
b9719fd6f5f20b07126d237ec94a5377a2f03966

SHA256
09933f6c903c726fe3eab627fec1f992e77e39b1a13ab7d328a6ec9487f30c36

SHA512
ab78d27dd8e7432a3550ea4320e4f5234196f67e5ba9612ac2f375f916e485147fba9f1a5cf44596915a33741e219acd2c87d6efd4d28d6ff8c5f4d832b08f64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21e9caecd39a15bf0673e38a7cbedb83

SHA1
80b7e7994b4e3aa8ae62235e548ed19acb2b08d2

SHA256
3a5bb3892f24c18407aa4ac9748d7bb6114e1bb40ae1b842991483539c3283b0

SHA512
67a76561c32597ca5c077ea18423a32cec63b5b8e73527a3cd1754330ec6eab47e22ac89b17ff6c0a79d7206a6fd73bd66ff6cdc0d3ed89d55e85e3739be513c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09b5b6717d76e3450ee8a726b4c3e509

SHA1
2bd7215ee7386d47a681b6c15ae6ec384edfdf5e

SHA256
6b8f670485a39bd72663be827c7495597e0c3ff6f1c80ef3fc665f695a912749

SHA512
686487775db23c9904cb6f41bcd3c54b4331fa737cd6ebc0d195a3d36eb4590a36c721a35cd39861ee20c8d98cd4024a5926861f5947d07e0f62ec2fe129eaed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa9d6d16b81293a02420fa4317947046

SHA1
a642609e27b819042759d4e9f9184c7d6a80650b

SHA256
7f67e6e807d4e4c620e948927c72e26d776a0219bb87e7fdfddc1d7212f41370

SHA512
3b36a1a107bfb451c3b1bc127e53bb15e2f030ee54710e48ce4ae06370c6943cd5a4fb6a90d2621c61accecfae25a50f3f78fcbafd736e258e6de25f2452204a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b86e604d0b04fe3c083ba180c33f8a38

SHA1
d0dc0cb296d999969b1eb4ea438dd811b07a8371

SHA256
95a257812b385ada6c8d4e18493cab76d2ea8dbd6587cfcd20d6814e69b9d720

SHA512
b75b5c53f85dd94099f86f690e43f1d67bd4d5f3579a9e54774e34b8bbc673e53df5ad4e4a1e24b945ca22a0bf233416b2661b2d5f66fae50ae2db1df71f7744

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b679e4f33b45686700ae1d297993ecc6

SHA1
afea6c5c709ecbef4cc81887c4447469bc00473c

SHA256
ffe93bbe55531a259895e5409cdd5c1b251cfd6fae573b7a75ad3b595a08c282

SHA512
49a7ef88e88362f3cdf93182c5039d36f9b82f831d122717dc4975f52c5cba21c5cdae5ea6035ce34f5af9fa926fe79b740d5353f5ede5dae02bca440fc3b5f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\cb=gapi[2].js

Filesize
64KB

MD5
ee01651d160cfc55249d6011a3c45916

SHA1
79d6121df6575974ad21dafce33ec98e3f2f0a7f

SHA256
639d75299973c7d3794eb7eb129e3b5a6139f9f521e1f14383abd0fd501219c9

SHA512
8a39dfc1ff2c58ac106225976aafdaf7befc0a28903a0c65e2c272e1967c3336af2b477ec12604400bb8e16aecee6567c9cb9d157e3d54649e28b9b2f920432f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6WEH2YLI\478691279-postmessagerelay[1].js

Filesize
12KB

MD5
92169c8a0fbf6e404267d0705cdbdf42

SHA1
a5cd88b74ca5ced239cdbfb458fe25540d671f46

SHA256
dba668b49a111527aac8f616b9053ea57c944e01a84ebdcd02a13da921223384

SHA512
8c5d35ea512fa7be367cd9a9ded2f23822dcce730e5502a355ed0d48949ef763eab13be0d50a66de6b0f8419d6a002c12c4ddbf20d97f5393ba922e48a4f02e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E25VF8N4\rpc_shindig_random[1].js

Filesize
17KB

MD5
f019fdda31635d2a31b151ad8ad56c7a

SHA1
6adcbec55f66ffaef83d9a134423aa98eb2a2189

SHA256
c7fc0b1526533002c956ebf8e8c42c3ad3f96c41ace73fb4063cc89051944831

SHA512
fc278c12316e098976833882a38c788d812f9d36bd1b9b2b8c87dab4dc906af26a860df95436ea1b7d509236d44d0533d475a153437f8f5d42653fc28a77ad64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6F39.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6FC8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit