5a5b3ceb210a270b47dc64e72234e08c097dc91eef2f749ba955ad4aa8be33e2

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ea94e65c2af29c94bc4b67dd144dc80d.html
Size

852B
MD5

ea94e65c2af29c94bc4b67dd144dc80d
SHA1

24655357770f16a038937a21455e7b8b98e34a0b
SHA256

5a5b3ceb210a270b47dc64e72234e08c097dc91eef2f749ba955ad4aa8be33e2
SHA512

c27bf3b16bd0c65c092bb58fa208c6938e232075ec03fa8586e08882e7e69b3ae3e8c2eb77dcaace764b69105cb9d6f3cb90cb7746be879a649bb0cd8a9782e2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79F9FE31-A112-11EE-B683-EE5B2FF970AA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608239401f35da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409442996"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000c06652abe91b4b9c184b17d5f0c486bd94904cb0299d63ef21a7a1635eb2c701000000000e80000000020000200000007ff67f3e72ab6b9dd3e20240009be93140e3484e1cb8672ad054bf52a07efefb2000000032aed6dae2c0f018986886699de476bc5305f3095fb15368880868aa954d000c40000000a18f2f74c1c7af3ba1aba9b1d88ce184cde8bec90af9ffe3d0e4a130f9d731bef43b4fe71511888fdb1df955b5c1b3607622f29bba1f7328fbf4d48c1cbe10b5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000b0b51c03e6655d0214d8454471e7eef167e3ad35dbd10bfd9b0f2cad7067d76e000000000e8000000002000020000000fa4e1b693ae09e8addaf7053b6447165ca6a560fba959f8484ea7d012b3518979000000025d8b859783930942ba69c8ce7282d23d823b4612d72c8820f788f34769a43db4c2cbf21592c209d34f21533e4a1c0a32d89d3290a3c05123de193d612280cfc01c1a36c78f6bf95b0137333a061e76d3075c10b4768381a00a384b01bc46f75be009e7fa5800a3be4c7dafce191d79e1865621e80133ec46440dd73ea05b789bd143ab98788d45cceb3eb820673023640000000e7a00221b6d22559f563f16aaac6ebc818d8c9db2d9e83e5b1a280d2a4670b142d6c697c59f5b807b5e62bd62fc0e33dd8b42dbae3d6fbc70708755fee831874	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3064	iexplore.exe
3064	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2348	3064	iexplore.exe	28
PID 3064 wrote to memory of 2348	3064	iexplore.exe	28
PID 3064 wrote to memory of 2348	3064	iexplore.exe	28
PID 3064 wrote to memory of 2348	3064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ea94e65c2af29c94bc4b67dd144dc80d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fbdfdea5ea7f2e5a323673493f20c0f

SHA1
50f95f9c67f5bdc52a76958ee10940604e8053c7

SHA256
ee9023e167f9f67dc3336ee0ddf0591a45daa7879adfce22ddd7d1363b023ccc

SHA512
f75f5ee70c8ca5657fbc1f25ed66fd86f0d5af35be1c437ef52c55149707303038dfd5fa1a8249e3a1dcbe6ca7ba15f70710bacddb32a6e383058edc5940128b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
155192ce66a0aaed33738fcb98d67272

SHA1
86138d0b7e2ff9945ec1898417b8f261786f5ba3

SHA256
96ecf9107e5cc82b668bf67524285c9989c122361804b6b2e8561e6e2bae6499

SHA512
d6404e33f695d56f1d8601f07a49cca0f902124b61a39663cca2f6b63c3d888c19c1e5e24fe3aea6788fad8e17bb264198766a80d4ec10722e92b17c003e4622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
618b2057649c8b64c6a7116982b7770d

SHA1
0454199db44183d2adacea8b90d0891488967a33

SHA256
714c0024bf782e2e2506c9f1887e2e9d2b6e65371416602fa5cf19ee5951e621

SHA512
7ef6ef4cde3c73af0110ead643e1ce3a7422182757d5dd0ebb1f72599c028149062505589d82fa4776c092bf2383596f7841c55a050b02c6562e3e5b9868dbc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed92d68fb3b955efa07ebe0930c17e26

SHA1
d6a617c1c753d8dc434f1ee2718e75e25c76d24a

SHA256
0ebbfabb453dfd31250d55fff576b1dcb7eee97c86c67c232ee77ddf24821220

SHA512
2ce66bb481a8f4c1464386880cb3bcfe2c48c1858af4c1dfc0cc9a027b14f70867580e55f6e62a77b64d8917322bb90017eee301f3f604980efc6afb971b8ee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27f25f3f12eb67362b3cd180829b1196

SHA1
2b8ae8bb26512f1ce1915b9ac924930629e83fb5

SHA256
095afda1e636ee9622a5dd0c14df22b9c269ed6f16ddbfb1a1e2e2a56a533dc5

SHA512
787e1041cbe172a81d5f2593cee5f635e5ffcd381ac50f43e8debb439fd2251322d3c191bbcc1b0456c55d08d5829f92cb518ecc49a87f9c4a6cf58bc42873ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56b1fb4881fab0f237655008ed235b44

SHA1
bbcd7e5c1fa249072abdde057dba744fd3e89d69

SHA256
2cbde2e7ace74606e349aa4f54ea5b8a70b93e835ef3b4b93ae9674e8cea1358

SHA512
1056c0cde36134f858f103292539443dc82266b3ab54c3a0c816544ffa0f684e3930bf3d4f545cbf6e7d74fff552b773e678b7f0dfa8c6005460d830ee6a85e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58b62ddb7cce08b7e83cfeddafeedf18

SHA1
f529bd124b0e4f5ca69647377353c06d243b33c8

SHA256
00d3942afc5b1525fc8b6a0e95c2b9a69b400d631414d3387deeae5ff6722c36

SHA512
6ad71da27c819462236ec99e0f1e7d9b46d8716264819abca1760dba428c275e378495f8a7e0435fc40e867323677e3008432897448aa8733f7c26cc8cd90c5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebaed1bb1eec382c7f230ed1bd3d8efd

SHA1
aa55eda8a7ad0a81f9322b3f7444f110151c3965

SHA256
485ef3f39e0ea4652882cdce4a4a694cf2d74b0fdf0a29d2aa17e08a69c866d7

SHA512
11ae2464b56fb5775f9b8bf6651fb77341d16020156769603ed5b896b3ed396dcc0f6c945530d61a0ada2c0e61c94fbad978d856240535dea430fc422c1af0ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa175e12d85a94e9e67365f741115c1c

SHA1
826bb78dc8af4df25f1556b0bbcb0057b97e217d

SHA256
95b72de07a8ddda4c8f7998e6db923c9eeafe212ebc0242cc98760f121109e98

SHA512
8b5a4451b927d2577ce4d454f6f85cac549cd130756d169b625d651b1bb18a2b4281c7ab24485bf19379683102d883d42d349725d0cf31edb9ee512d695d14d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ad0e522b139331ce6673edc35a8982f

SHA1
db6d95558f7876207c0885ea8215ebf6bae9c249

SHA256
edfffa5d68c24d00066ddab7eb2d41c3b6cbee611c726f69e31dc4bb3d284bb9

SHA512
0e3db0d345ed4b8039245bd386b0decf62e45fe3677010ebe4c6dd3930aae8d9ded193fb36cce28c5b89d1ef0eff5c76ac83a8e6257d0140ef6731611fb58f8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
103eed0d3130a8bc9da606ae98b9d3e2

SHA1
d55700b53e99ce053961f57ddd38d13ca1a9abbe

SHA256
2ed1eb8beba631c54aac41ef9c757868954212a3d83eee4de3633d3c5841718f

SHA512
416e80306e5a0f0c50386fbd109861d803b7c3f698234501e58effcf74649fe54374a64469866a62d6481c81042ff7a51cfb4348590e914f0138364187f22212

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d09ad7ca3c9a4dfbd537c30ee77caee

SHA1
cde5fc81d202095b8dca9143928db38cd6ba83d4

SHA256
09e969f7e7d400e185d1838f02ff765a625127416af2e2d682fffcd9f5eed7b4

SHA512
9487dcef0af13a89c1b0f8a8c9083b3ef71821b222a1aa62db65c47ad4308f5ddd0cc99a7eb5ef0c1215287a2491a01a206e94476a9af05a26d65c71d5e98b35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d1da212954ee20b66f2986569d9d9ae

SHA1
5334995e8187d1aa55b03a9ca5789ad9d7b7c3e6

SHA256
e4ca889eedce8356f63ef2fa84000e976214c77e515dadab3d00b8d246b124c1

SHA512
e0bfd43937c6fd664594f3664ca68a2c67d92a2fa63a8711a610e81dd3c2f525fbcda0c0816166f8ecdedfe6d721d68ec6b5a3722cb5ca368bfaba31365383a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ac0d99ca17daa9631e22dd3069e2ffd

SHA1
a7534fd1abbbf75b79bc3ee71c05b7d3996658eb

SHA256
49a592b17515b0ccf4f45760db1064f412c2964863267a42fd13c0b4939199d9

SHA512
dc3cf30f8aa61efb9f9953c5e17c83acfad3f7ace3f91edba33b06495e0f58742a1a4588a56d0f2024d08257fb60da28be62aee451675b7e3037c4f6c56bb69f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e5d60802548844d1be8d1a9e821e2d4

SHA1
d28d315fce32dacf40d36e0dde20fbe6010f33f8

SHA256
69472504fbc82c085ddfb3569dcb007c9682e4b61e59bac7b351ec2b63179a60

SHA512
914a239c1926cd2cc6f0956ab99ac69fe31f3808f9722944009007435b57d85e8bc05fe7814c1b990eeef32faf2eb94e56fd3db734960d5e4f470b2760cae3e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b15427341b48ba440d87604391958346

SHA1
ff995ec4fce29cf728088bd45756a3e01751690c

SHA256
4863e19d9d53e40f0fe26c1a61a97135e26b6357c40f3b2a710eb6af1ed11785

SHA512
fbabbdbbca2a0442639bbfd38dba50fce0d441529e61d72652000938e8019b0a2ed86a4a9f90cf0d5402440776afaae82aded2c148bfd6ee20a5018b669d53e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C95.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3CA8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit