e487998d818beff5606201608eccd698e2a5c8ea96ea6ce80d54c6015547df79

Analysis

max time kernel
147s
max time network
218s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

148505c0880f03a7c62587e869e914c4.html
Size

6KB
MD5

148505c0880f03a7c62587e869e914c4
SHA1

c90931df5d2a2f981c150f7415906b2b7d706436
SHA256

e487998d818beff5606201608eccd698e2a5c8ea96ea6ce80d54c6015547df79
SHA512

ee2439173614581daf72b6d002259b33dc04c8152e111aec71f66b2c2cca912c83c137359ad0377cfffdf61a6b398c556f4b650576d00f124effe06a8b096443
SSDEEP

96:uzVs+ux7R2LLY1k9o84d12ef7CSTUHj/6/NcEZ7ru7f:csz7R2AYS/+4Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000d61343e53ed88b00813f82019bad38b5c50b09eff0980a07b4c5ad0380ce66f4000000000e80000000020000200000009e121b5795cb70b427410e479bd20abb97374a68488cdb9b054c9080c5bf9edd20000000c8d3a203e78e31570c7ddcd1a631dfea277d714a2cadc9ffc3f563e70e1fd5d84000000054d5c063e9110577245f9a8158b406635dea49db6a83cbc6aff500fd10d65dcacdb5af3385cb45434913652b0f0981e86f7d1a5cfdc5b1ea94e3f0a8e13007d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000b72813a7940399da0232ee9a8c555d4f27dcea7c0455fcd4b0b4480a72e4ed02000000000e80000000020000200000005502fa0919319bd8a1de1ce3f9113e29c40192f80d0207f275e04da46916511890000000bb5849dd47edb636b08b1ea12438c0d75312fb204f0fa69e124d1499941bc5c9145b67e04ac6cd1663eee169c8afe528e0a2379da338253f98243e9655de1ddb095024d41a92ec9d7d4724eeffe6723a07e3d6ea8eddb679aaf655dac66587c9b56f72f92a840d23c62d8ad9d4f79dc21752db7a80e6a724bb9d805f26c96e643880f530d509ad4cc4976eb311f716ea40000000ea4035a615b9afb9543c4863920e990ab62015c207d9f8c3440ab87544fb4084b33e97c70a953da005471590f490d15db0e1f85c3641121420c7be936968cdb4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409700353"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AFEA27A0-A369-11EE-B311-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10311d9f7637da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2628	iexplore.exe
2628	iexplore.exe
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 1692	2628	iexplore.exe	30
PID 2628 wrote to memory of 1692	2628	iexplore.exe	30
PID 2628 wrote to memory of 1692	2628	iexplore.exe	30
PID 2628 wrote to memory of 1692	2628	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\148505c0880f03a7c62587e869e914c4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2628 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ca41d235892e98fb6ebdc507fc772a5

SHA1
b5863d89672bc3ee97de693a84fde3843707139f

SHA256
f0aa3723bec20df623a3ed48cfa1723c102d14e49512481a44810ead559ff9a3

SHA512
e14933918510ca43085d72991062a2d6c890c1836e2e4bd9e60b20f92856d047541198a5affe1c1223bcbc0b9d248c12c82bfdd2ba63e47182368077d70d027b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e37ce06f33ca96e3c5f28405f52aaf8

SHA1
f82563ac3a92911d2cec59fcab32fe8d6d5550b9

SHA256
18e24200ec64dcb6d07d84f71f8f0d4a2e92487dee067831188897386d881ba9

SHA512
33969b44bd57d5e52cbafead27e92eef6830d982e6bd5e6e498eaf59389659717df080d235f2b8294edc341f91bae3bbc2409b52f0e3fb7b66fd7479a366b6b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6928de37c6d269b34b5678bbf63a58a3

SHA1
abc77d5a21007b4fb63f0644173cbaf02317ed1c

SHA256
83a8b287606c7038d5d753078f7a476bd84ce6e1069b0775bef8a69514427ceb

SHA512
583796769ef397bab62c6f896da9936ccc62f0a2900a5c4e694071c2a5a767a7ba3e73c5e0fbfb9a17aad6001f03c7d01fc0e570699333df2d1dbe79610ceea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3b3810285453d030c721951d275bcc8

SHA1
2350a6b2d0100098281f49636f593a47656649c0

SHA256
3bbf04b05bf42812f46da3e1c3e1e9209452ddf17a1793787b4f56e8d1becf22

SHA512
c2bb8c00fca5ddb6742720773bae1d4a800c31f545f29b6b436f2c0a0f8ac3057da7cfede0d2d9f33d806916c66f0f98d1933be0154e1e256a819b036c0d162a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdc16252405674f4caeacbae3f5bf15b

SHA1
226c24d196f46cba1bb66e5bd7af7d9a53360dbe

SHA256
b98dfa7f01681b5a0ca54d7782b170a13b1d674b6d16f878b8eb3fcf6e82a313

SHA512
d40d1047a87566768f7c88ba57f89c9e557dd9a1cf3936b885462f69d0136967ebb41f8bcd694cb7c298c45e8b87221a294381ed713b9129acc5daca3b044ec9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dabe1fb46e7aa104830a5a60beffd322

SHA1
dfd46b9e25b1f014c9e79bdb0c21e437c71a7981

SHA256
dfec668edf80a5309c557e870f827b27b490ee08105526c99ec4bf3fae74a1f3

SHA512
33fb7b7dabe1f6dfa76bd04c4bf42770c24cc5a9c221db50fbc9a004d6b7b75209988615768efccdff4eb90c5e90842c2e18ab2e3570294a1361805f6c6b211a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cf8e4d6a2f22547c4d45cb91ea0a707

SHA1
99fbadc425afc0dc7af9785b804c721489f05e6a

SHA256
18ddadf7e00e62f6425e8604c0ee05d7ea1476717f1d85ee1ce22ed932b45f79

SHA512
6ed901b5a99e9ca5dd01598692bf60c342821d400ffc08a24b3493572d02cd1403be38e2f88d1fdc43586108ff516aa5670e1dab7958cf1cb3b6ca23b7d2f420

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c73d6d86a47db8c02cc385a684054d9

SHA1
78549a601038f45c98319b5447fd233169234d39

SHA256
3db9de94ad5f3abc884388d46fc7c1a7607ad945200dbf6b3b3f016891784962

SHA512
c3ab5044939b942729b05545aea145cb84b5a7856901b08b6b82f6e8479c3daffee81493847f7c42e20b1d01773b44a4aa26e08e9bcc5f8720ed58cd14a40326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
642d891ed2171131fc4d23be9da27316

SHA1
ef402cfb2b1fe52a449d45d881012f5a99804fa8

SHA256
355a4b588938add129a52ce893a152c31f3100e82c5ac8477bdcee6d18e0f77b

SHA512
963495564b967d1673c7323c090b0bebf11c846266a9329c360d54a1f38d458cb5d3a73a2359ae2a12fa5f5d90d5e9af67ee58b22e326d9ee94a003a80350bd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7319ed0c209a2ed7edb8f01d119f22ab

SHA1
7a765df466f98c3a2ffad17bd9f1fd38b72694d7

SHA256
42e68eead41b1bc591f98be38533bbe46211bae90e5be5111324d072e659ce08

SHA512
24d8a2a6bd8a165bc1532baaefb1684f7c0096438d3337b97d2ef009c3c62584650323d25dfe03c6648a035ce5acece7eea8feb4ba0a7d6886e10fd17e127711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63b1c0f20f2b4f0ada255c580254ac14

SHA1
c112e4be4289872ea8746ea2ea7d987111206b1f

SHA256
0d5eeb2f4b4bd11f73fb56caea26f7d9dfe17be92fdaa6e6895ef029546c7a30

SHA512
34e99783413c2e2e9a77d4853e4fae54136007a237f40a834a22e12c73f23f423dd49106de6909175bcf909a370b9cfaceb57312ceda79eb2e9e38b2af79c845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7af9ac20aee4a190c843cda30f69f98

SHA1
e8e806926941476542011bf35020de1f0ca34d5e

SHA256
b38c592f92ca97d99ae25150f3b5f240c383bbc9ec3b7257f30ac2a4b2204d0a

SHA512
5f79706a46075849e15fb21929548205659ceb42b23f4ba2fd54f7bba1fb8ed1ee66c2fdbbd72f48ca0fd8189bd4478a8b160801ef3a32f0407389e2302d0f6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf232e88e20cb98f94fa6a0fe98b9f42

SHA1
9205de5b1054311c66d4419b8acc1add4bd9b957

SHA256
72d781275223236d0e12ff222e1b255650e77666ef7b38ae149a934e6a4baedc

SHA512
db31ee45adf8a3048f706f24867fa2cb6b8b7ff0439b00567a038a475c74741a258766ee1224729424abf18a775e5b2e263e8fa71401c20b2c6c52a10838d234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92865a132e7e50476250a91f0a3c69cc

SHA1
80e13f644a9ecfa6b194c30ea669d6ef86385951

SHA256
bedcf6683c68b45f935c233f6bce8ee3fb43e03c281d45e002db39ad8bba6736

SHA512
07e7ce47712b5c9bc1a05f8a695b994d90c744200569c233277218002dd5f53cf5c166bc82652526c9887be02fc0fa4b610d28c44e969028a3ac0008c38471b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8AB5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar90C1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit