ef5c3657eddd2032e2b4f210eddd354eaeb807b157ab67ef913b4dd9e39662eb

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13ff22de4e5d0e4bc4638aef98bce9f4.html
Size

25KB
MD5

13ff22de4e5d0e4bc4638aef98bce9f4
SHA1

5355b1abda53353864dcd7c821d91346c0c8aa6e
SHA256

ef5c3657eddd2032e2b4f210eddd354eaeb807b157ab67ef913b4dd9e39662eb
SHA512

02cf5fb30fe5cb2376b77041d1e8e639d4b78bb14de5bd7bfd0086b58a1ced7ae25de40fceb6cd5ea2465d68eac82afc0c3854f6b75f447817025cd67d55f7ea
SSDEEP

384:QOnA4ywsGpxJsbztvukeKXXTudwobyJXjLIWQQ/U4cR1LeeIYECdG55LkuxOk7gO:v1eZtWkekyLe91k90t

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000078fbf01435b3e1e29e141d134f9040b1366efdd292595d8f651f77b213747e84000000000e8000000002000020000000abfb90c9434cadac9edb05482753215caffec4f7bd5dd3564fc32219ac5468ca2000000063454acfc71c7bd1860355f2817c91659ac34c43734967ef306071663673079e40000000ee4353339ac2a34c86266838779b48fb3bb9bc2ec669c7cfddb85ae07e4fe24bca6df0161ce5a97ea9beed8094becb622127d4b9e077cc1c2fdfae7218e29dbb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000077953714cfc50e0d7e2b0b0a02286253e3f488b34d8a6abbf8633b14c755e4b000000000e8000000002000020000000d5728d8f7b6ff5b33e7438dd7ee517c1616eacdd0f721cc72e7727599c2e9b6990000000c519df6c79172cd46c05d1fa3a33c40990f779837b78d680936f972891a2297081564ae5ff516283554fcd6535fdfbab0e6f4c920267ed290fb04c9c5afc55cdb80437fe88afbf5ffc3fb475d0e251c006fad6878502acab6ebbf7837d4c3b1d1a44a4440b7f97d3b3830b376ddb165cb7da70df4c068a61bb9172fe4bfb2d097ba89180db42c0953922ab5ce039b68b400000004240538cab5e145b1929b1cccb92c41a5450f48666bd57e26c5b5d6ff31ed83a57728ee95b15a0d0d29245525b1433d061609b9686834c9fe73a408bbc585698	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A91A4E21-A362-11EE-BEF5-6A53A263E8F2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 607d677e6f37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409697357"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2728	2416	iexplore.exe	28
PID 2416 wrote to memory of 2728	2416	iexplore.exe	28
PID 2416 wrote to memory of 2728	2416	iexplore.exe	28
PID 2416 wrote to memory of 2728	2416	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13ff22de4e5d0e4bc4638aef98bce9f4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd3f099a1db142412755ca79e9c3cfe6

SHA1
88c578e5002592f2c267cf60558360d17c2511a4

SHA256
30dec64f16474323ee50327a45762200a80b3d03617c47f272f06b0ea4b529f9

SHA512
4eda7ed6929d968750efb62c38cfa49138eadacbbb6457439458f561887d0e19a19eb415f323d0a057dfe9e5f069d222bf8928d7679ff9e2e5b4dba617c990a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
684acd3d49d13fb0478cdbed0fe227b5

SHA1
9d51dffc4ad56699b626f6cc14f5a760feb23513

SHA256
cf59244f36987f4b8ccd837844488d34eaf32365c1c8bb2608458ddd1fb688a5

SHA512
3d9366a825b1a56686f403d6cb9b375f0f8b56fd78798f77e4d3d1e555db669a7ddec84599170f541d83ec3c3044d1b69765038a739ec69e43042116850158eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1742c9e54dda66d94d0633463d8e60e3

SHA1
37e4ab2c1c9d901fbce0c91afa3734f97cb9f173

SHA256
8f38ae6f21a36c5b6cf4bb30a20c78c048aff12bfb5be7e7b207810010002cbf

SHA512
ba6d27620bed580c3eb742540e6f82c9b684419ed5d122d0408823d40263b78e78875d0ff221ebba4949d5567adcd34e8962e97c9480cb007dbbc13df4cc8ec7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
377ebf193cd62b5b712977b3ce04a446

SHA1
96079f8cd7960feceaae6f73618143c40d49a390

SHA256
238800f33cd7b25d0f9d166d1ca14b43f54ae24a43298c63c461b0b3ed6c7e1d

SHA512
079974b61ddd2bdc89b0476ae0925c15d5df7a1e2c2472059a78190a7ed54f7cbc380e4e34263090550e079a19aea95d44ac3988d778c58b70386daa1ac3c813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72f8cadf85778103e7e9c2716e87c383

SHA1
0c8dbf7ca5659341b3eef7e5546f2b4c8cffce21

SHA256
434c496f6ca59ff9b3d22f3063f8ec3f6f5a6b76f801a6f24dcb441463ce86db

SHA512
09f596a1549197e5f5135b48ab9675114238ca03d1711ff40573586155b263ee9478b7516acc75632cfcb41383d472909b0bd0134bd6a83fd8dde50ee6e676dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70cf295a73df60501b617367f870aada

SHA1
7d3a72aa4b7e401bfb3f73da921c0f8129ed11d6

SHA256
36ceac55b9526df856920e0ec668436b950da1f0cf0432d5183a633a36af995a

SHA512
156adc0797a06865aaef96c069399979c5e47cd11ca1968f9802ffd6f889e1f55e65616a359238e3be8f7eaf8acfeb3184eb26342787b81d51b9a274c78ca2d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fe3359ca30e2062ac92dd627bd53506

SHA1
d0ea30a6570cde12c51f54c3cb446a9f1e06e4fe

SHA256
b1b471823ad02e100b9e1912b9d1d7c2b2a687487b580fc3261d503872454b1e

SHA512
91d3831bbeeb0b59f928c5109f3a81e2dec49182434c28ef1896769b9bcb3ed620deb8461da62f053b55696aae7a6b998ec3cb9b6ed72da23d9a058e1f448358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82e89eff9617f706c4785b88e4147e6f

SHA1
bd89134de83a1b2416b958c65a4fddd3c4e27d4b

SHA256
e19011909d3cc770176122fc73f914af6e706501f3fe2d160e43f91c17b8dfa6

SHA512
b7b9b026cfbe5d46a2cc4823529433c2f22f26b80e2d971e9249457a19fc60cbdb71330f71f7f497cefea6599b6d1c80c6cf4db8643ffd9cc2e3a8a14f37e20e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ff409cb1617255d2f418704f31f05fa

SHA1
d43391475feafe48f9ba14e39db39f4f56468fc3

SHA256
97268d84f37b2f3dbc6d92a7994aba3243b9bcd2ca194e44891a7739e22990dd

SHA512
cef999e1b96b0b8ad32c7e9f301f946c482ed7cc4df4b43051c5049552f71e4792fb1bd1759f9a43cbe1470956afd5357e77bee190ec3c58332c3dfc723b03aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a746a9e72dc11679e10df23f5a979435

SHA1
ae12fa12686a4fa65cf6a1d8d9fffa24826c5545

SHA256
f20927e0f7d102c93427eb16faf752ef699bdf612ad15db262b79f283fd53189

SHA512
5f8f2260a82b90b873d4e1c95227c75f56fd7e8431a038920f9fd903635d864af7f31ef678bbf40e88cf22f952ad1cf0062551f05915a2edb7645eb95ec2794b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cc7a151440ff39703da5ed2f6529dbf

SHA1
51d92f4d5217f8983db45abfec4b7a710b26c1ed

SHA256
06d4b598abd56645ea44cadc10093e835a371543f4bb90f88c0cfafa720babe9

SHA512
c51149a46c723fd5b43119b3c391fa303523a0264c401ee2e8894480ad10ca93bb94be6ee37b9b518fe74a8b2e966567a0919c837111d8e7e4578ceeae93453a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a38736f30215c5234cf1f8be44a06ad

SHA1
655882132f79c245272ee1939dacf1d6dae49155

SHA256
427bafc66d32655a7a51360d3567be2203c3581fc2cd9d9c4aa8037c8808f703

SHA512
f553a1c1d8f2f0bb55e5524343cee1766821b3fead977b8f653f16c9ded09f4676698da554b9bf6071376ce1029f2c4be5279d0020e2c35da1fa86387f701b3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91f2fbddf2078a3abd6e5a35ae5bdade

SHA1
f4c9db87984a5a5c1da2c3d9633b94e3b7007a6c

SHA256
de07b5efbf57dbe1cc17d33bbd33336de1c3b1909e95d7d8fc6261015d308b0b

SHA512
2c02f6683b770f21ef1af4422cddf573a5610d45fd6bc0e625c7aa69517da2260a99891215bfa3a13234e529232c4fe41e090c15b26e46b63dedbe1ac80eb53b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D8E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E2D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit