e74bf78c078725befd73ead26cd69e78591ac0821678c55bed0de215e47df584

Analysis

max time kernel
117s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02a8afd7144befef841e0652c31fc45e.html
Size

53KB
MD5

02a8afd7144befef841e0652c31fc45e
SHA1

f89a11063544c0c634e59f5c6ae7248e49be357c
SHA256

e74bf78c078725befd73ead26cd69e78591ac0821678c55bed0de215e47df584
SHA512

14031ff2b6dc2fefbd0b3b853c1752d008c8da7a3f0632d35e29de417e339af3f3180fe32f99244809481b9f14154b80a09ba961db5797fcf3a1f8c796a376a1
SSDEEP

1536:CkgUiIakTqGivi+PyUurunlY863Nj+q5VyvR0w2AzTICbbooB/t9M/dNwIUTDmDw:CkgUiIakTqGivi+PyUurunlY863Nj+qU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a264b370a234150509539ace5205f897d2922267b17d072120b297874bfa29ab000000000e80000000020000200000008408aab5ac1116c320dfe56e66e35542f384e30203b579f66df690f7b4a174da20000000eb70b6d9065411f6b22e2d10ccdbdf32f08da89e1bce197dbd09e9b84b56bd07400000002ce8b7bafc38551ddcf54558b6ea5f628fffa8ef96cb9e98aaf5fe4a5b0bc18403d79016cf5b01b8689760c57ff3f0aba45865a0975af6642a4327133ecad9c3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0cd5f689f36da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83754E21-A292-11EE-8CB7-DECE4B73D784} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000fe110f06b22d1e8a0955f362ab6c98f02bb91f29b23570695dd36f65dd3722f8000000000e8000000002000020000000088995e4f420b3a85e981b7aef46c0b8579cb98ba222e8c93b1a49c2ad6aa55890000000a30fc2dec6b692d9af63dca66c07f97d591af7204cfd3a67c2190a801058ed96534775e48c130957ce351882f835e839216880beb65b04c8ce19177ad64f698bfd98bc368f36c9301c91de6430ea204938f9feed2cc471ea2694c3ef8d58a85ac093aafb1a0bc00ba16b691b9d6a76f2bca632265a2082f8560330c862d84d48e098aaef15973958e35ee9d4407133e340000000776976cdea103d1b9d3056698007c16fb5037fce0b3009907587d17dd3a53f48898bc2b2e4357b1323b7101095e885588a5a4a9a2f1c66d048e53e0d1069e60b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409607948"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2360	3052	iexplore.exe	28
PID 3052 wrote to memory of 2360	3052	iexplore.exe	28
PID 3052 wrote to memory of 2360	3052	iexplore.exe	28
PID 3052 wrote to memory of 2360	3052	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\02a8afd7144befef841e0652c31fc45e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38cbfe91780702d9fb5c938fa9924a7e

SHA1
5e5ba9212bf43816caf3c96d1a1e51196e3aefb1

SHA256
b5f5c42777dbda641348f0b05137da4a17c8b44d301817b5fb619955665b5125

SHA512
e8d7ead0dcbfbfabb2568eeada94c53716aa1951587ddfff163dad70dc9cd59dbd597291b3a5a47a62fc0015fb17691f909f6453b9498bb0cfa4122d18973d62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
667f0f07d97986f6388f9f40276802f8

SHA1
864c1ce5b6dd6b46a703222a88390f4d7003f0ec

SHA256
267901af50bba57afd630dfe22e35b746a8fe34bcbb16d497bb8c6c66ab84bea

SHA512
3f8a23c144603a54193e8e298fa3939d78537a4a32f09bcf3df5680903f44c446c8ff6aef5bc682131d8b585389ec2aef648f5ecc8f3064b6b84363bcbdc36ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28ae680fef2c2d765764d6dd7497a8dd

SHA1
0fe6697b5b448f45479c0c372681099518875f4a

SHA256
ec4874f5883dd0e21f0b53c4eecf9a907d66f09483b842e448583523645ffdce

SHA512
333b44389d6ee75d17730d4066a22080c876bf00fa2043f613574858a7a01586b732c254bdb8fa0f64e0f318096fe92ee8ee67ba697e969c64497ad731d0b691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44f8883f83a4d451ce648f0b30f848bd

SHA1
4612392c52d66d64dc8df8bca010b20edacd525d

SHA256
5b3643a8368dfcdeafd2ceaffe20b80782f6b0767c8bb897d1e55b09bf1efd1b

SHA512
9b5acc1a6f165cfb0ca7e4885a6d40ed1cd1ddc1ba57a545e579536ae1f1278b2467f1efb6f68a0e4e6bb44e7216ba6c39cbe54a8925e01738612aef44416b18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
330b0e2e98f4070a03d35ce6ad030734

SHA1
977805a579d41b39ff3355d8f77d79789a609282

SHA256
abc5090e6697bdb44992f1c2106ce640eb461d9981abebb9185c53a9effe2bd7

SHA512
cd40f55a572469a07342740660b7937179e7bed30c732f5f692267d9f069ea38e9f6fd6a469d3af5cc83397896806d461095a74d5ddaf61f43011e87afa6df91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8902299d05876a25c2c7004ead33c1fa

SHA1
226accdff27bfd34edaebd4e60e300b2b7f59f94

SHA256
afc1a64dab616c49124c2f559caca783ff03ffb7ec24609404e1a0af71a94512

SHA512
f225a506252a1a4802c56c3005c9d198d81e627732c0a39053f3a947f6c25c4b14fa744b5c0a9252b7cf10f48ab45cbd22891d8dcf22cb81e86ca4f6b44676c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba6d6d711346ecea325a7b9731cbb9ca

SHA1
a29726ea5265e21365325cd739be637c3fb619cd

SHA256
f90ee0437e37c754b23648b85d6f892c01e8d982e6a2cdf605fdcd22c2fe849d

SHA512
29537095ed3ffe6f56cd6b9869f38963e301e373397aaba19f9ea7dabf80ab1129d4cc734571897a4f6c49dbb3dc063c338c9a92dfb6bf6316265dcc83bc8ca5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf69906eb36fbcd004066827a1bc4894

SHA1
b7b3fccb11c961a792cf31cac28450d5505c3c0b

SHA256
6be093abf0359b9792277dcd2d31c3ac7fc48b3bc63587e81cb9c9a4e6f65aae

SHA512
eff8838193a1caf2b658401dd7d603c0943b807b47c016bcdf740d375264b3ed5c49cb0aa45dc7443fe802ea4c690a9f7c26fa32a6087f930729f9a89e8c4aba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ec302b01d2d3fe09d8b2b360ce38265

SHA1
d1e57884c5f3a51277aec9a61f8452dd96b9fb8d

SHA256
09e9ca2b68e7ffafa6c7085279c5c59f118af5bed81cfe2bab33721d70a63b0d

SHA512
0f083fd4f782bc970092bb324dfaf9a87ebd12057a54cc8f5c46f0a188f79feda4bd5036e119cb1edf4f523eed94c11c9be5aa4704313d77790db74ae9e3cbac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28f8fab0c974532c4399184669fdeba1

SHA1
9e498ef2c431e7ce57358b9cc681c35b200b761c

SHA256
5a75abfc668f6bbfda0fa69b4ec34ad8caf13e54e488f772bdc1a8c4c4146a61

SHA512
313f5d7dcf146a68df57867f5c0660457e8ec595436d292fdad5f3a411d14831a48f4d36f1e366f92e557cc71de1c69cdb8077b56cdbacb7ba202f0d8ad2fda6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\glossar-js[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12B9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar131A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit