e9bc595efea19295d88fb703b23c609a7e5434e8825e10a2ddaebbac89f3acf8

Analysis

max time kernel
139s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 21:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13ec07cfc25c508c1d35f3bdd32715bf.html
Size

57KB
MD5

13ec07cfc25c508c1d35f3bdd32715bf
SHA1

d23d34ccf4f5a86b8e04f92775d2983b9adeaeb5
SHA256

e9bc595efea19295d88fb703b23c609a7e5434e8825e10a2ddaebbac89f3acf8
SHA512

ebdd386b716ae1197a455df9f6f947367bf5e38964736fe1d23dd500973666c9409a4d881b7a86c6899a1e571fdf9047fe0f75a96808e08a3f02e6b014702ae4
SSDEEP

1536:ijEQvK8OPHdsAko2vgyHJv0owbd6zKD6CDK2RVrol4wpDK2RVy:ijnOPHdsA2vgyHJutDK2RVrol4wpDK2m

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409636748"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9957D4E1-A2D5-11EE-A5C8-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000da1fcf8c2fd3971dfd6cac9a83f19faa10ce555b2011b445e24b341eb7a7a8a7000000000e80000000020000200000007c2754bc30f1c72d1182d0325de49996d9c03667fa0db124b6e1c6b90146eda2200000006766f20d5aab2bc3c6e98460065ff084ba1e57dc2942684862cf820eba83886c40000000e6cbfcf6fee6c73b3e863e4d480c10d0b2f84d5fc41c4b63ad3b47a0205eb56960cfefcb8c2858f743691a98a815ecaa005e77e379ba4df92cb49a8e384f4d71	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30649879e236da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000006dd14bfd72a1997bc05b216d9475856546e8a408eed78cc58be78d70215221d1000000000e8000000002000020000000d2b40608041b57c0979938677598311f7ad9549b228ca9e336d2c7f2c166895990000000fcce913c60f4ac7a7ff34c59432dcaf782b8dc811d4268ba72009469153236f3a9ec655a8113b92ddbafae7ff75c0f9b6dc25a38130c0bb1f69851359f25d9f1b1eda5fc2a9c008f1d1df23e1d149e65cb59d216e7c2571ecf93d27de67f8b401af756432e5fa0674eadb338e8eafb9ecde375ca8a9cec6147aa8291f2b5707eecda9b4582ef729b889406f99cfcfd9c40000000dfcccd68058e0bcadb7ce101b93052a977e4ae26188779b9d265b0af9fb4f4553f200ab5137ff78845075f82a6746be0f5fc850bfe1b45b931daeaf2bd3b8d18	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1340	iexplore.exe
1340	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2140	1340	iexplore.exe	28
PID 1340 wrote to memory of 2140	1340	iexplore.exe	28
PID 1340 wrote to memory of 2140	1340	iexplore.exe	28
PID 1340 wrote to memory of 2140	1340	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13ec07cfc25c508c1d35f3bdd32715bf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
dbce58f0d6f033f4219f91172ba7039c

SHA1
a0d031ebe13113238de9c04bef9258a03212c35d

SHA256
ca5fa66cf9f5dbdfba2d5ac88f67db7d98c25ae956dfb1ea5be01cd07c759d05

SHA512
29dc10c396db2f93f439b2ae70720144d1c5b2d4b7674aa886ff568a6039850984c581730dfd0613f108cfd3a94935f891a61a25bb1dc97748da55422b5f0fcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
797a540d499ef5b6a88efb0c1418252c

SHA1
769560e0ad389be2be417782448163e61077b115

SHA256
c5decfb42b64e3bc5ef2f85607403e9b0ce4289955df8adec0605e2e932cb3a5

SHA512
1be873e90f4fb4afa2e25118eea4ab61c1a61cc5e5dbdee8ef315c9d60c44bcf2e2d5be251e914f527cdd1e574c6bba0b38d5d376f0ea599e9d2f6d7fb43eef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2d4975411483b5d7fac9ec334455433

SHA1
4d4f36133b9739d9aa61452152ae6261bbdeceb2

SHA256
2d05461e330b7be2e167b80ee0f8b28b32f08310e58620d1e84833fab1153f3a

SHA512
3a03be1249d23faabf13ed93fdf27c10c2426c7634840fc778065bb1398fadc5f202e4ca7611abb179b213aac3ee424737d99fa58fa6579361d2089d0a0fd29a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ea3abf8137bd461cf1be56cb8fa5344

SHA1
2d9889b3fc643e706668d0d502b1f4a4f6d7203d

SHA256
eb2565c573e5d232b8b98ebfb22ba06e32de1df5d8c645623ad7e255a73e6218

SHA512
0e78f2f0ba2560a9df9e46f3dfc4916bbc2194fb9090f9e6c415352142b4d7184035d7665a045b67f844b7e85016343c9967855e407db35ebcf2b5cfa9fc9746

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e1ce2a360a8102726825a2bd75c7c8f

SHA1
d116fe919f76ff3d743630cd68f382b2c5167a87

SHA256
259b96e9ebd1f0ad3f6a2a293c73244a94c287cf02a392773c7a153ed9209935

SHA512
b5570a59a29883b240c2ba8ff7d89c8747a5b74d0447506a2c5c68c93415baf02c4f8c801ee583dfa4bc9ba86a658adac8bd7a711e82778dc62a61edac5297a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
956ac7ef697b27f2784d5d7c8ef5f708

SHA1
06b87a4dd0db13f6aad7d3a68283af7c4d4b038b

SHA256
d8bf5e5a157f0b996aae0db341195baa6e7dc15c805ffda0c5dac9e2c692a080

SHA512
f57ed1b6282b2d3118d3b936e2a59d9c791820b1c00a83337fc8be631b458c2eb72cfee4798951015a7e8fc5fe4f003ad7fb609da05118fbef33594526f346e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48270ceaa7ff9773c0aea281d3df8a68

SHA1
d6d30a6e53b0bfdfdfa099e3b6635a5a75deb067

SHA256
2fcb5bec9b89ef4140085cea5784a55f2a4270053a41d71cfebcfa5e5526e47e

SHA512
b228bc030f6392ec27b58a0a090c8a302170b5e7e8d4f420975cb1344ab2b3c57c3613701a957f40ce7143af5ec57331be30945c70b5a0466fed5c7da3d36af8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
420da25ec6074551698d63e4a1591363

SHA1
c7d61032fc9985fe90460f25811d81cb01cc6a5f

SHA256
9cf99b45f5e3fec490815f6292c29a64b612d4c6e1df231b70f5f1650123a68f

SHA512
3758eea91cb08b4e47acf21949c2ec6e9e8362929951b0133f731567226acf280150aa4099f283d5bc6f909763e392cdeb39ed43705847ca53477664a6e3b699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
154ca94a06db50f1f02d1b31b8f52988

SHA1
e34d4126b8b8014f07a97174893505b9695058e1

SHA256
a08f56790589d968b3041bdbb589cda2c186ba566784d72c3b00bb3adbe36aaf

SHA512
2c16984bc2f27c0fe1482ba5dc20db3b10bd0205e0f7f651bee2e94d5c8f6dcd03771a9c4da4573775ea2d37fb6975fedd7502fab8e29a6456b0e32ff733634f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
281d83dc0121ce302b457dc56b473dbe

SHA1
4ad7ff8c97cd13a579954fd57eec93b91895007b

SHA256
bcecd72a3e1ac398bdffa7b826370fba1900a9b393a0664d923370a502eb225b

SHA512
dbc320fca100fbe850d8b908191c4a97791aff9656e9f513da0e7281e7384a688eb6a6b2403af30be97a3ba9398bab146a25e16976f608cda2373db1f7885d04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7cc2aeedd6970857696e5a385c83966

SHA1
6d2e479cea3e29a06353ec4cd3b84483bf428d18

SHA256
84b30cbab45cb5a9ea59c8329823718518ac2404a4293e076d8cd1bd242e6bf7

SHA512
b47926965dfd9d4809bb8259860496940e5c520734f16bf7f7bcab40704135a848de4941ff8a1841e4b96e37b692110d58cd4bb3467b610e40190c38d97624f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1YVWL6AI\f[1].txt

Filesize
34KB

MD5
177f413f34f6226df1a1d91d2958ea4a

SHA1
0f70736bd5035ce5f3ac9d3cfd65299cd92d35f9

SHA256
71c78f0184044c0b81f320c30cbc41136049f84b951901edf9c36ac9949a3d5d

SHA512
a2348d8193fc1a5fc76322956d9ed7925fa7af7e0aeb5c43a7151fc9974b3b5af7d815486551864b9404db36611433b70d4e7f3f5876420ffa7254840b4f050f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab79C6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar79C5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit