e44d2c2ea7fe8c7f99958ea7ba792b887a345bf2dfbe2d027a28ba54f64cef8e

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15062308abb08a6b0d1938a37b7e50b3.html
Size

10KB
MD5

15062308abb08a6b0d1938a37b7e50b3
SHA1

6c794eaae45918daa1cc55e1af837cb7c22143aa
SHA256

e44d2c2ea7fe8c7f99958ea7ba792b887a345bf2dfbe2d027a28ba54f64cef8e
SHA512

0cf7058b17b01b4ac5e70c86e2b5add8875c0c553462f984f224a05b3c970d48c5047e6688cd661e75b3eddcb14a0d020d71829698e63996c58b167ba3bf6085
SSDEEP

192:SIHVFviD+gQ+dAN//ltSsmGVm64Kmvr91EWvqzZvKFBN3iND:SIHVhJNzWvyrND

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4DEDAB1-A2DB-11EE-B928-4AE60EE50717} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000af985f95d317d6e5776919d8526591fc64fcdad718b4828c615b91d76b2d22a3000000000e80000000020000200000002ed917620e4624c42183b204d217cb7f12d3476f59fa927c7dee25396133f5dd900000007be4dd6803e825de1c3a9fe2e1bd3e59279701899c418a3028c2d605b42e76b60ad0ab07f44705accb0e196edd3c502f725d6855f0a49b3f7cfdab0b1388cc53b3cae86d991ca247b45efb1a3a20a146c37b2703966542d275d394b36c0acfa6daa4ddca19ca18e4a707efc9fda88449e1d59cf3933a7a0ca7796e0e4cd51ba9356cbbaaa3b49a0fef155c260d5e8e60400000006b477177c10ca4e0b4e52a350ee00af5f887b9157fe6a82aa37fdaf766c5658159ffbbff50169de017a042cf0603f58e3a45c4aa8b6f57c41fc38264533afe75	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70bbec7de836da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000062a98a42a2751c1af89c359566cad5808b026817bcb2b7a8a4e4fe05cddcb31b000000000e8000000002000020000000b1d4edfb849f3cdba63bcf187fdfe98d282beb56f862d5382171f52e91d4bad820000000ff71314b69c7efed778d631aeebb2375e51db5a0030e59b599f8ee4e1925392540000000df2870f781ebf7c652acfada30b6240ed30a63a3a2739e9e8ee6e40db945520a5136eda1932592441850f760c9f2ba212e5ee3dc21019d79e9d7bf55d522c1f1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409639345"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 3064	2164	iexplore.exe	28
PID 2164 wrote to memory of 3064	2164	iexplore.exe	28
PID 2164 wrote to memory of 3064	2164	iexplore.exe	28
PID 2164 wrote to memory of 3064	2164	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15062308abb08a6b0d1938a37b7e50b3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16bbd045f7d0001c417d4d1f590fcf6d

SHA1
f32f8138d22adbe0e48d653ae1a999d737bff6fa

SHA256
74c9415bd58197ab8be49693736fc94d3d6561b6e6b6fcf94ee51c453ed18d09

SHA512
948e0cafcabbc4107c772f8eb3b8d5fe63aa57b6099543855223837627775b6681a976b7f23d340c922974f08d09bea998b6bd9b21808365a779a606342d06ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abafbbf304f4581ee0ea4c960d0bd29b

SHA1
64e445d45b8f5f3b888c105dd329e110817e7a90

SHA256
0ad7ca618f356991310179b8dd23eabd86f94cbcb800b5e1aaa69c42dc50b7fa

SHA512
c5e4486106390c96fa73f60445978c1bf5e9221a8800209dfe3261d8110560273e92392f1a1dae9f606ef3ef5d0071f8de441618799d07595d60f068e5617a43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0c0c47a9e37d1d4b166a7ef2d3ec30a

SHA1
2dfb4ebd8bca97c22eebf802de490730d83848d2

SHA256
d177f5643d60f6110699917fc46afa7534f3516bba019dba9ddadf0112021df0

SHA512
1942d3ff7e6aa9ffdb5e5b57ef4c1db92ee2c264d715c2d338ded7ceb4fb8549cb6cb466b05f1a50c410435e6e1509e42d66c37e0dcc640283bac82bdc08b496

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc96dee742a801c3645f8ed6d243fcd1

SHA1
11dc8c5a3f03e60af7a18359588a72a26c3ad359

SHA256
fa577135e7bafc9dae9ef6718bb5fb93e8e4d7b5119f0f42d6d9f86c7bbeaea8

SHA512
f6991265e060007f25485326f310083d963ead9c129c79c9d2589a04eae71a8bd8a3d4f94fec1a4dc87124b256668bd028476d0ec97669d7205d81dff7a1b553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65aa546c327d1bf47df0e2d83156fe2a

SHA1
093f94f604f068dc5591a8dcca7f51102371d078

SHA256
2790e75214a344800e3a885eb03915c74e75675c81d11413a9e42e50b2e7583e

SHA512
97ddfd13fda209e49d4d9d31a51f7030535685dc924de45cb54b524e7783c7d50bcbc109a53896784f35dcdfc61ba010aa23983a7ed7602eefd5f9e16bff6220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
546b5b9d968225c9916ce41319bfa0d7

SHA1
d24222bbd1ae1a5b06684e2c07dea13e20b7d220

SHA256
9ba3af2612e4347ac3cd33986e9a398495ae9df2ffce04c008c8203091a51e17

SHA512
0f475dc88dd26a066c2b022d3c4f1139d5c4095a0d5e9c6481ca13a70942b13004d0251295d5ac5785b3674d982f1da72c4c27f71c28d57428917c7563522345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27ebfc38f66bb4b6330eef052b365ba4

SHA1
c1254aae2008a570e7dd2964b8710d0fec9e9214

SHA256
ffed01651c4fd38adf398f7520fc7055dd9cab8140ec0d341e5b27bb1a760e83

SHA512
2510cf9acb0b7bb328ade9adf9682c3eca1285999c240c6ef8b74dfb33f9cdd9bc32ca6c8db2952344d01e1e12dac4057a838f05ed5f42d55b0cd9e1099d6c59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa3d3cf8de80a7b2da10748e3f649534

SHA1
330bd695ac684042d3c392f12150814ae7d43a2e

SHA256
02da9994b5e5ffbf5f14ca8f472fa8d2466a939805757a0045bd239789682fc2

SHA512
e2a4872cc063ded9e0fd6051e6178bef8e257d13143b1e0e60fffe05468154fbc7a48273929cd615d58594b9068dd5113f363071b457ec56308a8b881ccdf683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc721669b16810b39bd9219c44cf0090

SHA1
f714fef15bdb272c078b7560902ffa1ed08e8512

SHA256
79efb87670f3b5e1067d0862b2187e59c49aa3c4d71fa0e7456aa4ca74221440

SHA512
f49c861074abe5a978b9c60e86284e782c85d27aebf4418b89cf84edb804c4007fc4bd332896a67b053a71c26c868848862dde243b591ad84d7aee4e59b76f63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdcbc05efaab7a9b4263afd853ffc33b

SHA1
cb2518eac142a1dfabac27c688619a12a5d8f927

SHA256
47ff327d9b522a6f26333f1b5fe754d425329c2b1e53979a84baa4f690e790a2

SHA512
2d5152db075e1683ee475941a21b41a3e0d6b6923d5948edcec498056056d75df09a1b9db6562d5e335976d9eba8362a11852dccae76b05d28546663c895388a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c24158e59afe7925e58ce9be0f6caed

SHA1
2adb477f2192f96dac490a389dcafcf06e980469

SHA256
01dea62f360fcf18f5eedc65739003075b231a1a72852ca6810d735d0cd0d32c

SHA512
bd214cb726c46a2db6360d9eff43ea053da9843c6ae34148a56ee01115ab304bde13828261d7db65f01890b6ef95f1ca8e4bb61ee868066dfdcd561afbdb6250

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c09e97f5a93bb3879d7c6174aad1d917

SHA1
4be860c239dd593e88da8f7c25960f35b12a9988

SHA256
27e5a55047d754a23c5b6eec6bd5a585cad3f58b58ae36420e941cd02807993d

SHA512
f7d2d83671d98ab4a889f3407f94b0abe4c7fe37547045a9aa1a7e3da18b24e38a8c1317c4e5e4433ba405785c4e696a252c5ffd13a1c3a53dfa853b8cb68d28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfc0182a851e442a911ae5190cc3794a

SHA1
4d006f343bc2a610ebee8fd9931b6ff1ee2cfaf9

SHA256
576beb6eef4aecb28992d7c1b3973847cc65dbf5b406a8a5bdbdbfaf9b6d1207

SHA512
61993794dc2684b1fe996ad1823d000321c34dbba1e8cf2b60a032ad60de095a08185799c85a5a085b27b1335d15dddf10f43c0dd2b9d5697b171764ffd0509d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4EBE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4EFF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit