89be9823656fd576020cb41f6a0da81831426a88660c32147197fdd873bbd7c3

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e616d6c9254a8b2c222a3290a8707db4.html
Size

25KB
MD5

e616d6c9254a8b2c222a3290a8707db4
SHA1

756b740db5efec8ead360fb04919970717fdcefe
SHA256

89be9823656fd576020cb41f6a0da81831426a88660c32147197fdd873bbd7c3
SHA512

f18fd1c66511be91b378735e32a50dfbf4a871e7f6286657ae84eeccec98ada8dc3e5b3055a33fe1e9045a76eeefe1cc7c99327fefc958ab1ac4ba28b93f7a41
SSDEEP

384:/nA4ywy6pynJIztvukeKXXTuV6wpcPfZ85CLIWQQ/U4cR1LeeIYECdG55LkuxOkj:v1UEtWkekHimOC1k90t

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009d48f9d2edc6903c71c32a6d66f11264d953d486d709c9301503b258d3954cb9000000000e8000000002000020000000e5b12ca2f9716b52661e33e2b6b000743c23a58021ab23ac56a6c7bb06ec20f490000000bf3d8bf78f709af5844b739ebccb61a5bb8b5846282a0c8a7e1da246bf1e62290e27bb45893a0f1a6f953f54600fb35ba914622e2e87011c80a2ea6b48f4fa7b65ef42301dd45db579f7b0bc04536a325c837d9c1bc30df0fe65fa545e2eacd2c812761aefe8cae539d847846bd86634035411fcc0905f8defd6444584c568ab38db1e3d5199086dafa82258027466f64000000008a9efe533ada1060cb2d2dd5b337916813f16dd7035b0c9782682bd090cedbb7a4c20b8351d3c154f28546fa91a0000c108007e3d0a15d0630b3b9556b9183f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409557141"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 800b01152936da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000fa15cbd4e8b5a01e60d41ccf87d7d134be852fd506c9780b6a09ed97334b61f4000000000e800000000200002000000085f0682c68c3fb29f5255c1bf73f5f0d71deeff76f30f7152dee26170308ca9620000000bf4d29db605dea2f9150acbaf5d8f69d9506afc57c354d049297aeaf8915ecf2400000003970f7ef61c5bc7cbed80a63ae106c3ad3de4a957eccaf78c5e3d64f46f3ae431336fea36ebd3949ea6b87e7f6384063ff79f1c5919dc318672d4d3d69c249dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F7C97D1-A21C-11EE-B3A3-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2888	iexplore.exe
2888	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2776	2888	iexplore.exe	28
PID 2888 wrote to memory of 2776	2888	iexplore.exe	28
PID 2888 wrote to memory of 2776	2888	iexplore.exe	28
PID 2888 wrote to memory of 2776	2888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e616d6c9254a8b2c222a3290a8707db4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
265b4e2b1b8ba9bacb6390a5c0c9deb3

SHA1
9e412c0b6ca12caf1d5f8c729cd0b6cab052d4ae

SHA256
328e6743fd36adbc69fd8961f48ad5b2d92553bc04f5f4755fccaf726b0c1bfc

SHA512
458dbacea63d2f09446a6e17d1be211c7b35201eb29d781f0c2a07e1ffa2df18b6fa4e9987e41c382aae00692b15152e002127b1a2faa4cf7b0d2f663eafd484

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7d636aec09b804892b5d690da87f4db

SHA1
6b322eda13d5a5c15fffdc3c0619fe1a6a4cdbd0

SHA256
1562d6467f59ea37fc60d9280a7c32c3ae0ac0ef94d195c8cdee24b62c22d070

SHA512
438b44fba5c187e9efad2047e5b62d1fdf0418107c5ca7649cc6d00d530fedcca572decddd6434f8d2f5afe3be10f784cc430159a472b44365ba4f29fcde4511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ab7484427204a64ef9777af1f4e777f

SHA1
b9ca85a2189e3de0d950580ca123b36aa11e2c40

SHA256
0cb93d75ade7f8e0b6dff39c82e1112f072f7317c757c166d6c409907aa47a36

SHA512
8ea7a9275791d1d1fade230103d12811a7ed471f0bbc78be4993011076d9fdbaa0e754e1e898a91a5671f42ddc6d9ad26461a71903d45183bf516e34137b9bc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6f70f16ec66e0394bbc25175959d6fd

SHA1
e1f088aaf82a48cfeb4fe8e1de43df3da9a654d1

SHA256
2b37c26b63ede4cf39dd96fe602ed4291dacdcf531fce7c44e34515e228a2bc8

SHA512
316e593e4fb7f9b2afff2533a857226de9c1e17cda9a8479755c4c445d6539a8615314f163be07936509bf21a91a00620379cb0b5a6f714930d6f4a95b1c8840

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a84b3a69482a6efb1442eb9f2b5089cd

SHA1
fb9df759d77c0e5e60583a9926d819e440e68fce

SHA256
3ed61b27649198f39bc74951d51df18033846f364815d6e644eba13864693033

SHA512
bd643d445c6027164b7d8398e192075002671a2877e81e097e0646c735f38f6aa67b1989342a0b9d9bf775c99a7c7668a93d8ee971bf273faa2f7f304e5c48e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b9886743a81119c2db1cd3ec79fe5d5

SHA1
b318be129a514a1c2b2435a38395ce424296b9f2

SHA256
a7990dfca885dad5f89e9e8717e24a9a740023447165cb20112503b6107a1264

SHA512
b8638256b18faef3c4c4d3cabef8bc2279139f3cd89b6d5685f19fe67ee8b4625fff871f63a43f46772a83bba43146c53b13f7af659069494e6fd4e78891e6bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67ba793e20ac2f3d5632ab7b4d40d64a

SHA1
a9c184f1654351c49b2ef4f890691eb80493fb01

SHA256
8d3a4946e0f655732dc772ac5908c1060662b91c9b3067449d3b05a82f9e4871

SHA512
fcaadace1c84a3a105e1765197fde97b9cba5776a50fc2d1f4e3a6004770b035cefcc4fb67b9684f871f07b0ca75ac3c6e75ca29338da54f4128973a9fb668b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb8dbc20aa32897f25942ef588c49fc8

SHA1
26864d15b847ccd5634166ecdad1116c669b55fb

SHA256
7bddbea5072f514daf354ec7bca9f96eaf9f9b9c6fa34c90fd892090bb7a637d

SHA512
a25d4012fecb38025db2952ee26d5e6871fd063bf38ed350dc045c7dcd593d823ce2c46543dffeac8db3f59364da65517318ee283e0b886b39a599fe5c6ec5c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9e47a5708f8924cdda15c45aae70297

SHA1
3bb8675e58979a14a917767fd9c9fa1702692982

SHA256
473a44466ab0e3038ce0271a267e0d87782aed76e5ccf3df3da77daf5f3b4cf6

SHA512
a2974ddf855ad420e14de02f97320731342e3f59ed0fe0c979a5ae26876499d42d5e9bf4be9a1ed42787e5682fe5f97dc3cff53d7d0534ed34ca800ccd43d0a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba350a62a5477dbf667a42be43eb6546

SHA1
98fe8c02b0a2fbf213d379a97c51b8cbf23ea2cf

SHA256
889b1ce0fb020f22313babd36603afe62f3644cb76da310daead10b2708aae20

SHA512
8a9e06197af99cf84ae470724d0a0d2c841f48155c5f439a989dde9de4113c12f53fc13e606d9035880286979fce754f924c004f7c28e68ee7ffa1a9344a6567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9b41e2312acb126068bd6883010f62c

SHA1
88c9ac87366a49fb16050cb8ad0ccd61a395dbef

SHA256
6518bef279be5746f80af802b7d7c72870efdb7e788ec68aeceb3b6413312a04

SHA512
d7b43ce3ef41b3fc942673a476ccccb40aa3e5e5fd709615a43e90112c6ad028bfa64a3a51c52af2ca6dcd68dcdd602dcd26c53d0acb63842e9bc670689bfbc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab80E5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar85AA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit