e86d8edde290df0ae35a5fe065d646d91e1dc7db56a305eecf8edecec6e67858

Analysis

max time kernel
137s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04d2dbf92d3e1788cec028b0fab803f1.html
Size

53KB
MD5

04d2dbf92d3e1788cec028b0fab803f1
SHA1

7c003fef236d97f2bbd127e48b41b524aa0fe417
SHA256

e86d8edde290df0ae35a5fe065d646d91e1dc7db56a305eecf8edecec6e67858
SHA512

7432cda59483704cd40b2db9e032e88724afce4729f4845c0bc8269c0526d5484d618d47288e64c1bd5dead215a7a495227cd422637ac27ecc97f7cf5d511eed
SSDEEP

1536:CkgUiIakTqGivi+PyUrrunlYt63Nj+q5VyvR0w2AzTICbbRoW/t9M/dNwIUTDmDG:CkgUiIakTqGivi+PyUrrunlYt63Nj+qY

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{873E7C11-A284-11EE-B59C-EE5B2FF970AA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000005200bdc5ca9145c017bcca03f210a58fe87d0797852582c7856f2031578947e3000000000e8000000002000020000000bbc2ac42073293655bec8701ccd60d621bd5e0f5b776f12149fc5603322618f39000000029729671da1aa7cc238b4be62909f35c1c561e5f9360dda531392a723e00198889e1faa0ba18cccc7d2a25efb67e30da00bffb65edac9112f2be6129768b8b78a2dbf75ae8858912534ccf4e616d475593ea0c42237277f49ff25b9e0d97fd8e9be32e6cfa49be7a51613c9070a84638200eed7c3760ed3121d077c8b695e5e75f6737da67fba3b18c90c6b9b33661c140000000256803b27c44669ffb631b475c5acee02c47a22b2752b4143f32f58fe73bb6f908d03a4a517d3e6086d952466ac746fb41fbf9082f7ad3af92ed65a39659ffc4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b8e2d03a5db850938d11504e418cf8448300d74f44eef7a4ac3f2da789d0bcb9000000000e8000000002000020000000c7ced576f02f0b3b8781982965b989b74c8ec74e82c158b37ba90757d0f5e9582000000050e06dfd50d2aa18c95eb0852d09aa6ba39378e537aaa8fd6dda3277fe5ed7574000000080fd8a5f11da950bdf1ecdbc9358f8fe2ca1af8213361d4ea04a3805fa12edc10b78f31823e1779477005f6a9425d8ceea208f7495b34e765e045a5b205b5a2f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b9167d9136da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409601951"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1272	2080	iexplore.exe	16
PID 2080 wrote to memory of 1272	2080	iexplore.exe	16
PID 2080 wrote to memory of 1272	2080	iexplore.exe	16
PID 2080 wrote to memory of 1272	2080	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04d2dbf92d3e1788cec028b0fab803f1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f8e332262cc31969d3ad4229631c4b0

SHA1
c996a2cc7ed2174cc1272270bd80755a2421d535

SHA256
b3417ce76296b4a4a02a01f456b522dbedffa40b52fe309ef6fec5d09c81a850

SHA512
1aa5066db27cb6bf6333788cf3f4d9e83b679f5946feef4cd68557a993aca096d736abe35223f15945788e35a9d48e857709956701094a936afd40145e6c24fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dec7d239dc9b01b0d08adf38f4dbda59

SHA1
42076537d7ca80480305ea5d3c3a85c806fc0d49

SHA256
aca10896fd6ca19e80916797398c88a2d7d9b73b58dde54b86b4b2f95a2edc5f

SHA512
7b62f3fbec299bba13ff3706a395775f58d415d87fe1761ee176bf93f49c04b68b53521033f568816b89743dcf38c08146d5379fd6ceb8b555bdb75b9b3e6c02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12068e5457d5a19638d9c95360cdde7f

SHA1
05d824240d90271be211cc379860877c5e9ed9df

SHA256
22b413f4e250896a359188c54b84e4718756b4bb6fc7d7a66cfa8a31d4e0e849

SHA512
05a10662c080ccc72347308aaafe862e2a248359b93d75194395abc26a0084d4e1c1e278715fa86ab4c23b9f015c856c743a4b2144131a7eb12c63172db5eaca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47a4644a286fe7f72d1ab091237a9a2c

SHA1
7016a1a24e67b5d78864e9d0287017a2cb259299

SHA256
6a216e8933c78ffd219fde09087a5fb5057d5762aee0b0b38039add20a9342b5

SHA512
69c40d72089b41fc845dd05d0b43c71cd0cd0bf4065bf88eb6c290df07613c119608dd2da98a5a44bebf04aed06f5fd712b7723fb0cc86fdd4c9bd2a3985cc5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21f86ea16c599a07617b12caf30335a2

SHA1
c8636068fffb244bd124f7e69ce27287304b6e7d

SHA256
d5a16bc93b893cdc93a2b5b3ec65bd94465136d35a688e7ef4bfef57516d7c74

SHA512
0ca7194413e28eee0386352b90041bdd232bae7a8f40cffd32543cc35944a5c4ad7689c21f9b0159d21b796a2225831184da52d9628591778b1d366239e28b8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b02246a1cc24ff1ba88ad4f08ac8946b

SHA1
838a6710ea5821ed67ead28aed61a345e870f61b

SHA256
8b7f55b8bb856906718b3c32a5735967bd65a6dbc4ce4ab4d91104095a373e4e

SHA512
2c1697410edfa0c0cbb8ac539de6aa328b8a561fe1aab97313b77ee39793c46bd25de67a4db2b47e79d53f5153fed4d551b7a3f9ef288cba02e7e6478b86ede6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
182e5d1614ed01d60d415c131bb71b37

SHA1
344cce641c937ad6974b173f9d2fedd55db144e6

SHA256
88ed644c4ed4bf0e92a9d684f1a36efd99e45ed95fe9070b793b5cf63770078b

SHA512
f0988bd243d18e6e64169b456bc7085cc5ce532a105454a0913f23ed6a5560ccc0868704678b1acd66eb1bcf549d238b3a503894622c7601cf732e8ed14663e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23e04aa8519a4823f7eea8b2fdba3982

SHA1
15430135e0cb7fd06e4f416098597a091229ac42

SHA256
7aa30bb25e9fab0b497a8b1da714aae89e8ad72958ffe9637ef70ad5de093370

SHA512
b18e18926fb4d2e7b5b744d6f69ebd3e3af2c6288f6a28b296a98d38ea322241915e6729f5e242e4224faa2fc0104b9fedfc39557a1931c7f4b2bf7c712ea3ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ddc87c8a59dfd4cabb14e16be82e5c0

SHA1
2805b992e3bb92cb3f7ba1e65808f2b59dd33a3b

SHA256
88ebdd814b014d09082067e2970383cae316927e999a5c9973d7a504b14e08ee

SHA512
36730bcbf7518dfce00d74ed92f00235deab68a5aa7e3a3b5934adf4ceedabb2c4a36ee51ad4b3a0ed26f40983b59ac20816f87dd707cefdc418426b8f36d225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
886d8d18fddc1bfb14bef652c091255e

SHA1
5340ea96445e4cc94c20fcd6d0f98e7eb1590634

SHA256
1417e2a3e25501d17449c737ca8fb046f99daa122edca938415aa0a67dcaec54

SHA512
4a370e0d44a5bccbbedfb801da4724a9d6ea0fb1305214d9b04b1519f2e4772a219d9b5bcf9ac13e60d3ea8dc8276d249362c2066723201c234dacab611d741b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6IJYZ6B5\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab199C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A3B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit