e0bf5af14d02d6a85fa8cf81ac3c5fa8153a3688a808cf45943c0b9db87df759

Analysis

max time kernel
237s
max time network
269s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02f3d183e1a5f898f45b111b649fe901.html
Size

57KB
MD5

02f3d183e1a5f898f45b111b649fe901
SHA1

7351e8cdb0e5f85c019d8307a56fa3e979d13888
SHA256

e0bf5af14d02d6a85fa8cf81ac3c5fa8153a3688a808cf45943c0b9db87df759
SHA512

eb795711f7c2b997bf4a0385e91f5cc5e770c80e3aea8a2c05bb6d08789605bdd38833f614eb3d510740961db55a21a4fb5aa61a15dfa4dd3b97384e2a2e8e11
SSDEEP

1536:gQZBCCOdq0IxCJZiefRf8fyf4f1fzfTfpf2flfPfpfJfMfwfNfwfUfyfkf1fMfrV:gk280Ixq50qQtLLRONHxxkIlIcq8tUDV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000017a70b2b9bae984aa07117614b8464725a7aaa08e9f981aad99346d47b27fd45000000000e8000000002000020000000c68fdccc9249e712db0eea8b4839da42eb00815e58f3e6b9a43606eb1c2ea5a090000000f1f8bb4950ab00ee8f7af9d479ca8211cdc05dcd1d3ed8702747fcfec217a3d85a1d543bed354b6d2a274f1c03feca87bde34204abdf9afb1767ce2f477937dd0736d6c559432ffa43055eb0c961affbe43a9f910b6de0bd014b8a05d7fa97604285c386b4775bed1c9b941d3aa1b7fb535fcd1a0aa9fa3a5d118f32a9627a0bf18fab59758f0d0aae961a89442aebec400000007c1b81c0a5378f0d18a08ba453818a0218d16a06fd6aad3ef5ef8865d0fe9292603b864ba3a4316f1812e9bc4919cb7694976b7adfba60405f659d1efaaf1ba5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000039ea39f59c6197aba57fbc91b8111e317eb7c3f2e95f66ebd0950cf31f08d73f000000000e8000000002000020000000804127cc2984dffa60fac62b3054dbe77d881d931cfb3ec10044b9aeadc51de82000000059ddb256d412fc32b6efd483322632ab62d19fab26ab3c45257f86d2a9c86afa400000007ce385b8a02cc67e7e8bb38487f1a48333935ec7fa9fd280c177166f7c0f77fccda16a119ccd413265bde4200e1e42c530a4221bcc4f5a8e6e6432599f97e14f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0003795a336da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409609701"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{904531C1-A296-11EE-9139-CE9B5D0C5DE4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2968	1952	iexplore.exe	29
PID 1952 wrote to memory of 2968	1952	iexplore.exe	29
PID 1952 wrote to memory of 2968	1952	iexplore.exe	29
PID 1952 wrote to memory of 2968	1952	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\02f3d183e1a5f898f45b111b649fe901.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fdd333555c5f3cdcb1064af47e8f8fa

SHA1
aba089c2882a6e50f30dfce504f3c75b6ebfcb7b

SHA256
5c9d874a122137323392254a585be9b276cc246b7def55cb20c8dc7bcece1bdd

SHA512
160fb4484edc8f94e47e2ed9a026379a2185f3e51a4d315cb8385e74ca9211f170c2d1c3b397fe815bf37bffd26af48cf813c598efcddf6150a7eb44e55f4c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fc8cee67141fb958ba070d7875a5d61

SHA1
f45d047c637bec539c1940ca9707fa3531b5e419

SHA256
262b20856011d930e691c1d520b5c6c5185d1f7d4bc5e01ab8dcc20488267fd1

SHA512
5a91350fca67335fd2b0b2fdc697671540e03202b1ff4259bfed82091e0d6aa285467012f6954337cd90cd99d26bbff9a61d7ab741024026d1c19b9a3b9ded5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
813ad92099a5d2b12efa821dd8b1ec15

SHA1
c91264514991a04a2915b24497c8be254a3a54b3

SHA256
fc0612bc2e24d4757bc53db1d6c279cec0a282269449ea63c38afde7b561f7ed

SHA512
01ac122ab97e1ae3bf4831d4fed464706dd5e962e0306a3c329b4c61779fdafaf2338281c6473b7e1414563f2095d4d55dec2f824f97619f5950c81e7c79e89e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a67df5f0ecb8a286a82f3fbb76cbc309

SHA1
6888c2f7f7f1d4f1642755010dff4bfdb6047ec1

SHA256
fe452a38df773b7d53f752ffaedb42adbcc40b20b754931a33e1b3c1a6f3b645

SHA512
679f901b779ab13eff621fbe62b81d22534eff158c3597cd1c7b8c3f21734cd7b850faaa84a81563293e72f4272dac0b4d4aa60a52fa0de538e855e871ac4f9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b960d1263cffbad82798ba1f340dca3b

SHA1
cb19c6d49740b4bd064cd6f7475f40db70f88d48

SHA256
471dfb9eaaac55e54cbb8383c5c3bc7e2b72a129bba63fac6413dd0bfc675925

SHA512
7ef4e39779304a476f9491f693035713b1f93107ae2bf8e1d2151204c4716c0a728a84fbdab503597d2e2fd2f5458e16f485b7b67bec3efb273c4534e7689569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5fef4f4b33ccb17faaad5e3d2a63d75

SHA1
92305f5a0289d24ca1722ed274aa67951786c580

SHA256
7b24ded16ccfa2f5ae4229bc7366afd731dcba125e2a94b740c5c2f1d98cb774

SHA512
616ca253bbbb049055b6d5d991803244589b24087673266afa0ed77a8c8664535d824ce01a2ce61f8b82ed3f6b8a2ca1f141b34de89fa57077caa5a203a48283

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12cb654ad9f7d0e2d8cd5cefe126771e

SHA1
b761b84fc0e9af314a61522d269a2bf37216a0e6

SHA256
516feb5b5fc7b3d0d5688836a912b68d53c0a332e7275048c97affe5cf719c57

SHA512
f104db04f90c5adeb8552634518d5d4655279012990f9bfa1719afb91ac0da94e86e9d80bc2b6ddc33f334db46ce20a7107c6be228f94de9ccf4c667e59177d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
193825e8e28cc60a09fcdbe315fc7b57

SHA1
004a287702df7ff1b38a4b7e14a7c8abfe398471

SHA256
f7f1451ccefba74b21a0ce18a6fc31e3876ae2c6be20f0919c197026611bb602

SHA512
b1417777829440817d192b4b81fbf48957c335c7f0c76da84fb1b38ea694c16fbb4023e405229db2911cdeccaf8baa626fb3df333b6dee4c36efbdef8a79d77a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcc7338a4d2302811463038542bb40d6

SHA1
63e880e8ba21f0c95191eb1716015eb9200e1a6e

SHA256
ac1c7643e394204716919ac88532717ccbb9ab1d083c2e43f832a018b67aaf06

SHA512
301f82b5e61c3116173e3271459b407df57fcf2ca9beeb4b632818d1114095c386d6960466d878ca8d1de54e325431f621a130affeb625b08b5699af76c99c63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e21b47404c33d6c290035e7f65148185

SHA1
bc5fe394712cfbebd75bf57ecd034d141eaefd85

SHA256
1c9a870ccb975f993e09df1bfbc063f35826612729684654dab78e1d38714d5c

SHA512
5cf8a971af21a38489c8b2c651a514b75bbeadcfe9c1dbb56a2208ac11a55ebfffc30e6726db6aea26b78f23627363ee2ac159a6a30e80ee599543b59a59d8bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1ba2a0d39407c2e30d61a6f6443d006

SHA1
15c4b6f4d0364b35e94aa9e8ab66ad6f92153de2

SHA256
b97cc971825f86846a55d70343e8aa04dfa79cff030e9519785f4c45380441b4

SHA512
27098c23263fae9c36278892dce1208ba701f3bec92325c472b34cc919402b95c5ed752004d6c3ec649a9190ec81e873f1d3800c7b937b5b3604e298ca48330e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8f7701e1065fc3df3c911429d6a2821

SHA1
e476df8c691cdd4e02421080ca51510d19b36472

SHA256
ac496a8182d408fe7bd42b5c52cf70b0b5aa491f35a3706f6bab38b49edd919d

SHA512
1d454bd2b79ec47376f211a476e89cb54fea9f7189ce077e633b23ad7451b8d989a417f48198a484631a5c17b2974f813abda2a080086b326e078f133e359dd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ff84fd2f3a14aec9a11da5635eeab41

SHA1
9c53261cced0060174b5905c6a1f1b73e547781f

SHA256
8ae084116b7413824a9a3a8817efb4279e9ece011f951c037029a6f9286b283a

SHA512
3658f29e168c450019c7b8cebcf8d552d204e27c608c87b67ff81c9b6b7a08f3a543d80b738efa5eafaff62880b07284083201ae254851a47e865bf48efc9f1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e71398f92ec42fcd6733aab364e414c3

SHA1
08ca4a76d368c1b3c4cad0b589768997cbcad777

SHA256
af5b5d05698957e8463f7ac9934089e44fecf5d577f8ea6bd318b38cca388105

SHA512
47a98288c0b819bfa618b52204917a720ce357281092db6e714bd5b51c82cd17910e715d690ddceaa7066b444ca7aa79a1ee85150903baffae14327acd103d2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2293db8a623fc25f9c26dc326c9b98a

SHA1
c54252124ea72949e4f3ff2414c30a6af97081a6

SHA256
12cf1da2bb143b62db2d0cc3330aac63c1eeeacf411d90d6ec97aa95c83f338b

SHA512
574e4f189e4fa1ef56f1b93d2b2cbdcd82f93ef3c74dc431997d8416b1d4d20cd1ff08a4d95fc5dfcf2ae4f275675a497d587f23f88e5703e3c82affe222d80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8ECA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8F69.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit