9eafef8a99ea2aca69058c9aa332e61233fa19f6dc3fe0b72295ab3c915f0403

Analysis

max time kernel
138s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

049cb2cd13065e5f79cae904a6d8256f.html
Size

136KB
MD5

049cb2cd13065e5f79cae904a6d8256f
SHA1

2c83534df2dd80921fc7ec62b1b515467178ce5d
SHA256

9eafef8a99ea2aca69058c9aa332e61233fa19f6dc3fe0b72295ab3c915f0403
SHA512

fad14348dd283fd0d7ba3e5fe02e7f32bb0715ca371cc2cbeba8a9240295990b12b7e501f3206c3f431a3c2564e33cf40d1378cad7e45985378391527b0a598e
SSDEEP

3072:l1yZ1WYbxovuNIqgiJBPzC99LG9lE/sMnmBAzHlZs:WqEPBQc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a8c52ab836da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000587c053b578a85226d2ad8fc5b7c6cb7c237621140cfb2a07d547d20f8b8f1d8000000000e8000000002000020000000d8859f41feae4f95e8b88528fa28b50361f9905e164c50968e610f9326570bfc20000000083326d8da23f5a3c519dc62be265dc11e271acc2c7bfecc0265be3ef3be4d6340000000f94f1f698eb10da9ab6ee19d22e045a27f332177148935316a2a2b3b6f0caffd6858e1f86797d2bb5863e6a3ecde84b80358e03033ed083ea234a68e51df01df	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4C66F051-A2AB-11EE-88ED-46FAA8558A22} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000932abca873822375b4081d0b6ad17daac60cf3506f605239bdd0a146f8a04b98000000000e8000000002000020000000485e76bca7d344e4c8f6644420e0ed788be6b20cb8c318ed6f170992c5fdf88f9000000069601325fb6b1e828348e051d4799cfa4136baeb2634fcea6f41b0d903bdf8c40d1c4b5e6a5c27125d06cdc292f5a744acd304bec72f504707b4dba494fc37da000e3ea9e4fd20c99574e40f218480aebe5e9b6c0b73dead31b5e14063b0b654243b9dabc1514bdefb8c0c3438b18de2100fe99517bd10e4d0adf4974bf86792f695ac841186233cd43a5e2cd4fc00c140000000ab89d6f19ddb8b2fc01a5e35acee15242a364f7cfec6b2a7cd3e700e594eb1aa7588e89961b7bc78f468064dc7b9b2da28ef87eb30d820c85e60c28195f2b9df	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409618601"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2316	2228	iexplore.exe	28
PID 2228 wrote to memory of 2316	2228	iexplore.exe	28
PID 2228 wrote to memory of 2316	2228	iexplore.exe	28
PID 2228 wrote to memory of 2316	2228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\049cb2cd13065e5f79cae904a6d8256f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
e99c729661d361cfdeccb76fb786aea4

SHA1
f91d515bd1fd8fbe2a4d274f8062af1d0bd23a8d

SHA256
ffab13b85532e329f80d61cef78d604e593cf8d409e5aa117e3b9b3c96926159

SHA512
4317e4bc797f0efca9ce3ab3bc404e35d965a8135e5efc17a5b92c7751c060998339640a0f66d5ad815d7c9ccd06d34cc8f6c22d092d3698fc13cfd283ec3241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
5639b7fcb86582984caa97f954a11aa0

SHA1
890ee65c884fcbe5bf83b0fc013fe010145b7168

SHA256
c0ec02df7d34731f2ad16c5a3fc378aed1462981ebe68e12c24999404f21addf

SHA512
cdb9ea857783ce0f45658f4c278f8d63375a94eaf2beadd64a19b2e7ca59e6ccc73eb9bd97ea45b8623063aff3996d7755239dcb1dc98c9f574a5cacd6c26a87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1455f53e6dc8349727b29e945439e220

SHA1
f708d6ef866a9a613abb7dfbdc57997bfe4c5992

SHA256
c1f921bf215453aed8c745758a0df7c02222e3763673d242b227ff8d2a9be912

SHA512
239a89207aa7d3d167460dee931a0169a7bbeb8ff01be806eecbb165ddfeca634de746b60a8de955ed738abb5532c26bf880787a697ee90786bb83753884e886

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20236a02f1f384f831a0504027c65727

SHA1
d8a2685c0762592c168e87e5ec4e8cbab52206d8

SHA256
f26123c33941d5ddee8e95edc9d59f85ab758ca8074e8e65b60581f2137ae884

SHA512
ae3cfa5c532cd21330f77aa5ed48c980b77c6a2db0cdef575ac99be6de48586e057f18921ced31c1e362fec17e3dd64c9bae25308414405f424a3f5b88bf561c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
876c3f1c7fcb3873e7daba3833259277

SHA1
327b9af230b8575ab36d60dbd0334c081737113c

SHA256
f1753997c53f0839c38602c113cc051e447bb88043cec0994720dd26168fa8a0

SHA512
ef77a3ba2441ec6be5f73557f9753c191d4218f47edbdf8176a5d1b3a8d9158e5f2f7c522d18bf96428cd3d615e4c761502f8894a1925d464e7f1fc4c9d9b858

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb210f05cc0790f817e8b12e4d69a121

SHA1
e60d764ee5f8eab5cf5f586608699430d50cc0bd

SHA256
b773ba454f6015041817a0e454b11a18cdb30e3d1c91d994bd8bb9422823da04

SHA512
70fb86e73b421c6da2eb8ad7b457ecefb74d567dbae488d54f48d228e9c6f15479d926197c7dbeae7e1de826517eb5a452867c92833c0acb9a9b88b92c7625da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8681eff6e04fa8c20389a884be0a108a

SHA1
733e8899b76baab3fb7a4a7943cb08b49ba9cee2

SHA256
2c516852774d08be53d3773cc88dee76f55ec04ed28d8c89f704492bc56e9b8a

SHA512
d5a33b084540f154e18eab2b783c68cb06665852fee8a0c8ac59d62bd3fa6f107c3eaf219a91f3f885b4032f91fd930f09b0d5e253420d55d178f337fd65e6a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e952b314c07c181c51fa7a9fa01c2fe2

SHA1
d464da9f5f5c02bf71486e2a8242089ed546c04a

SHA256
4de29e9e79cd8780a5957c127502d874b27306a960f0339dd9b82ce4ec09a5e1

SHA512
5857b9e8c3f705b35f0176abc5ff51977c39476b8b782424ef049c5bdc12e1055d0c77a471ca1bf3f63bc450fef064119d0296d7ecd5874117f127620ffe2f07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7263d79d9e9b6e3398cbff9278ca952

SHA1
20c4bcf54346a334602c59cd17082e9876865f25

SHA256
39f789ca0b0b9bd07e04d37fd18cab76540ede9b75a9f3f71ec27e77ac2cc806

SHA512
d327f6b48aac49e807c4891618d22aef407e21d88edc3c5056c976222b02a68c073354a904365e8717881c445cfce04433ae265d8e9f6aba606f0a71debfe0e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f850a09e6aefe6998dcd30b7cb7efc88

SHA1
c97ae6d864de1e530725cca6cdf27b14f962a974

SHA256
461db28838b9650af58d6ed4c930a1018af699cc198e5d4467301fa942c81858

SHA512
d42bc754e930520e576f209e52cb6ed7f44a54e4b70b67a34fac1ef0e5cb662a6f91446d8e6a4e52aee4c95f657354df766a1f76ac0ac8edee6d01e37023551d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f49f4aa9d6d7e1ae92e671904098991c

SHA1
0ebd9385f5b51dedf886a8aea18d5935ef846ba3

SHA256
65a11d6d37c4f26f9d10de982dfaa69a3a63697b2136fa3b892159fbe01cf732

SHA512
61eff89cfd46e19df33dd76af93896196a155d2cff51dbe80a774d8c18e7a826181c83e96dbb01cf428a52c0adccfe5a2fc68c97af768104dd5d0740d135df09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d51c6529c3854e2ea94ab6419bc2a2ea

SHA1
f56426b8deaf982af88d2ab9490c26d36e76a821

SHA256
bd215eb5a20bdac6c06839f8c60dafe90aff8a8c4e1a6b1f0f904d655e1d1958

SHA512
45ff35b9c8f703433de18972a6fa20175251355497f1aec867457d30775a96f3914637172e3b1d23ca5c42b7645bce9c4cb0ba2301658647eecfd73b9bbff5e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
431df16c56e27977efff4618570e49de

SHA1
7d6b47110c1d9b5b74463cf9da7aa6a3ffc5de74

SHA256
60a10a6f759cc2325c706a6f99024ee89ac810103e3a9b0f7f395e47353c7667

SHA512
618e8060d821aa9f503eabb783fa8d4f46878f239bdf34bd40c305a25e2cf212bbe14c6c73c80e3945bb650183132825d0b73c34afbbf7f580770b3c9c835060

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
4bea57b7de09bcb11481e7e91ff62243

SHA1
ba60356f81bed3878685f64a000d4b1da135df7b

SHA256
64b33742bd17cff0acf6b1b1e102533464f0c7018d91c073635abecfe15bc13d

SHA512
93170d857297953ade1c03fe7d77e57c5ad40b9e3ccc43187dfd2b6afe060a18d01a89ae83f6f35f750e0b1e29cfb7b54aba38bd2e295ad1f3ddf8421d2870b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E1CCB52I\cb=gapi[1].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E1CCB52I\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab69EC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A4C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit