2b03801c4e050b789135cb99117ffa0b5e0f51356c13cf930c0ee47d25af463d

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e54df99434802ad11773aa42f8b7218b.html
Size

601B
MD5

e54df99434802ad11773aa42f8b7218b
SHA1

9a40d5576bd5e25e237dbddbf82fb6068b6cd9af
SHA256

2b03801c4e050b789135cb99117ffa0b5e0f51356c13cf930c0ee47d25af463d
SHA512

5eca9a9d2e735b501eb1b386091a388fd92b2396f413021a5bea14d79f4668e83e2f56d580662c28388c16e8b6dc91d07044ebe6dd9abbc003dc5e75368cf5b1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608497ee1a35da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d5bf490fd92f612bd175f57927eb383c0a8465be0cd8401f942b2e07ddd45d6a000000000e8000000002000020000000a4435c695edf96f4b93a6a72b7af295e4dfeb19fd4d66eb9ff20c1e9429f1d4b9000000086e3041591e13fe33af6108a51bd5c5838971228df263b308c5ae46f9fcf045afeb1babbf297b4418fa10281cbad8cb917f4826c62e409d676507bec461dc656628cfd6c76a917334c258fa904c44ac26bce5181dd49a165b48df9bfce773af8306a75d30fec49aad8da6ed4ef130821d552db562ebb652030726b48312ae51fcea221f1a4bc306b95ec9bab55e620bb40000000c2d9349ac5b7a3917e18a207f6a3dd8774ff18e8d4eb6536759dc1c4917cfe5c186039c8436780693c869e4a469fd87356b3880c61a26383963f6e0b6de008cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{299D3231-A10E-11EE-B754-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000064e9284094371d7c3e68ce52e66f029d12963d4e32774ffefd59ff9d7adebd3000000000e8000000002000020000000502586e3cff06dce163880429f8583dbecea09cba843a060869fadf1b369252520000000b9dd879b2300d12b207a0ea7b49fe0923efd94d380508af85e97774526de2c9240000000be951a000a7e641ce02cd4661ac58ae50747ceff34516eb8205b846e1c6a0c8c8518bde42b4ba62ffe7f0fd9dec9cbed66a05a30355641ba4f7859a269030847	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409441143"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
1168	IEXPLORE.EXE
1168	IEXPLORE.EXE
1168	IEXPLORE.EXE
1168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1168	2000	iexplore.exe	28
PID 2000 wrote to memory of 1168	2000	iexplore.exe	28
PID 2000 wrote to memory of 1168	2000	iexplore.exe	28
PID 2000 wrote to memory of 1168	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e54df99434802ad11773aa42f8b7218b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6906b3fd63f3924b5cc8e867d5f437ad

SHA1
e0ed18e4f10f62ff64e3508c8229fae1e6aa691f

SHA256
b7b26f73eb80863c9ec2722516d0339328b9b59947c150c72ebc44348c748d2d

SHA512
c0324f1a2d21abbc4df76afccf70d08a948b835cfcd32ed2481f6abbb5ec233816f0069808861eb2adbd34f962722765043e29410e029d824e6f78aa90abd968

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42ca6ca5a1fed78e4902604ad30effd5

SHA1
29d696ca163a8e32bf43b8889226b1a0875bf2b8

SHA256
314947b121d6f3104c07460da6bd49db44adba4af6f27341d39dd82e9e84c286

SHA512
7251c6cd1e42b0d617843ccc5890c0ede2d0e653fbc75b3b43a277b11ab97972324e4dca1717f19e37711441fc026ebf6fd01163313b6f05857a933f771a89e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45cddabb4ef99aac98a5980c0d1ad440

SHA1
f5c0c2c6d97a0883d6eaedc848d8ae2c0605c357

SHA256
1a9a73731c8a762bc11378ee5e4e0d90329bd60a2c049c70062fc8950f341ffa

SHA512
39ef0d745dd966ae3963e549727ec77fff2977c329777653613c8b9cf518838de52b6b72414f1190ea69ff045ca544997fdb47ad332aa2bc09c3859d5563be98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
527a3706ffacb3cf2bdc6efcb3fcac87

SHA1
2c644c9fa4218650d1a81b6e8e2fc92aef486e25

SHA256
906a45f603fb97414ca11d3629ae68bd36a70783528e1546696ac64e4241b8c5

SHA512
c64bd3ba3b5995e8f55733aab708327ae2e86d4ff07bf8e0174f7aac71d442042b7e7f87d7b2767f1e6054c6ffd4585cc7eea88b0ee59b9a5ba2b925ab19516a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff1a0b6fe3c28d7a80a9f996c2046195

SHA1
b82052a73b3616372060206c09dbfedd3bcb9681

SHA256
63294672a98591f0b87ba1a6bc087079ca3dc5f7235896be78ef2adbacda16f3

SHA512
bb230cb0a6c7fd2186689d8e65bf1e984deb61ebc568000498d00fc90d01de5b44dd397cfc9707e0d2626ed5375f8b47a5ae9baaf4f326b92a0c5ff42da894c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85f2193e05844f520d7fdee3a35ca0da

SHA1
3dbc8011b83ee0d0bd1d75b78fa4d347731d5cb8

SHA256
62d68f9876f327d049c828d8139438cf42f156382761b9b8f50e426b37b930f0

SHA512
d98889bdb7e2f6f22fe00013cc4c417e32f7c9b7904b3290d5f3c9f671981f01ab93749a3ad16ed236d25bf830dc0c014202ec845fe297da435502960314039f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17a8ec6107f0564f57b872122436edbb

SHA1
6bde4156b7f177cb72f7305205e5615f9dae45e5

SHA256
1ef2d18877232d42badbcbce0d7ff895b75cc1966b66ecbf765995373d5169de

SHA512
c1a7cb0814bd12ebbdf9d692e4aa910ca11f8dfad3cced1deb7ae934b0b2367d475dea272d1e677219adda4f3faa722d91cd1d5b94920051d9299d17dd04a71e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
979e12269a0642396e9f834672b56294

SHA1
f878b60caafed015d3ae293ed8d657181d9c1cc2

SHA256
1ff0ae6ed50cd53510b8c8845a3e4ae54acc48f58c9c97cd691ab1105f5d1f18

SHA512
f11b697e37c2815f9bccaa844cf2e814480d35deabddb6fdca70f7926ce02ae14197831a84fad81af9da02d429046b8d065284fdf9417754d9651cc7276884ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2de9379dd31e25986c617f9770686b4

SHA1
15693d85570a70955e426cb4b4c16735cf214623

SHA256
7ddd5dbd9871d140013c4ace286fdc0641b153c4d3e6c4b3104660ffebc33e5d

SHA512
4a6423867755e7a0a0b7ba33959649614d68d4c87617f28a198f7fa9b80e68c163ea2624da3e9fa776e02c90e33a6cc19985f362f5730ca452d57b9fb9db550d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f70d298176dd4bda456be835f1cc4bd6

SHA1
d5338d16ca2cceabc452b15d92c4669fc4449c21

SHA256
9571b4b7228c7e95587af4ed67bc907a1e9ef4ce3317c46ad9ad4657ed5933b1

SHA512
68a737142eb15f93d9862b652096b252442e3003254bff259bd101194cede65dbec2c773b37ab701c9afd7e355cabdf1fb453a8e9bf8569d0fd4619aa16464f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8778560f8b1371cebab9b3b47b292e9d

SHA1
16530c27eba4be87318ef9acd74b6617d632ecb9

SHA256
de68201f7207160260009d28a24d08c3d1b4f5e7cace7c5eb472dbe8952587fe

SHA512
e6787010f30866bbfd42ab6d20c1a720581c8fc2d65dde668b660065874e0fefc91e6e88ff9bef0ee5dfe6ed85e8024c40323aac898cbeb18b636edc7fe69bc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb858606946134fc8c720d8f3ed89f8b

SHA1
29486d8b76e2b9a4bb9f3283d0bf074e5cfd9c37

SHA256
f94bf23e695f07f33ab8520e6d4617f5ce730020739f604c5468674d990a2377

SHA512
578b0a0dea93d31d21afa394e2bbcd377da5e7bda4de0bae51a7ae6a0530c984a7b123d11541d07870abe9b9a8f7521b4cb06b2d1ca83304061e6c033130cd7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11dfe9832adcf2f2dd7a40422f819c6d

SHA1
c97d076348b4f8691723bc5cdcbbbbe4da17ae28

SHA256
1cc4767b2fdad9192df765b8c8d2736e22c7da6a4a5b440a96b7b0d14f831b4a

SHA512
6a308d4dd260169eda3df7efa5217697d4dfbf2a9f69f0e7639423787fa7980b8f6d781d784c7b769c2b37fc36e7ce541becc0baed1265efe5bec02c8635bab7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ff82b75360032bc21c634183f11133b

SHA1
7a27c014a11e6ecb58d79462fcc68afad64af664

SHA256
979b784428e8444bdd218b6f0b0f5ce8138ee3b79fbdac304544437a7635c9a0

SHA512
8f2ccbac6f19b78090c30c0f71cbaf93e99e3223e8fa684d560ffa29246018b4ded08571cdcb3596c59b23e684309ee3bbc4eee28e274c4fa49aa10d4b7810ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8A86.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8C3E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit