e53fd20e1aea201b5efb880978cfbf98e45f8c7eb9a5565c01067cc68829f194

Analysis

max time kernel
137s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

04f33087c533442bbb5fa0977b3aae51.html
Size

57KB
MD5

04f33087c533442bbb5fa0977b3aae51
SHA1

430b632d822b30f38ba54c70dae5e1f3af2c241a
SHA256

e53fd20e1aea201b5efb880978cfbf98e45f8c7eb9a5565c01067cc68829f194
SHA512

a45ec1820b718b64c5f0cb5e8188e1b07181617052443f3ac711247dca58dd0719f2f5d626b99e18a7f3e5da9b7f3b4e4e8cb7fe78f45747f5d1b046a3e68c7e
SSDEEP

1536:ijEQvK8OPHdFA6o2vgyHJv0owbd6zKD6CDK2RVro3pwpDK2RVy:ijnOPHdFI2vgyHJutDK2RVro3pwpDK2m

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409602323"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000004087d32f6698fe3951fcb490263b4f2ea9e93f2a045bc29715fe529425fe77c2000000000e8000000002000020000000c366f2a8567b4a57c36b522cf38b686fdd4ad07454f34a0a1b53ff59834f5b85200000007c38b9fa09f8a37cb43b0c145ae2f4cf058a678b2fef1541419a3f5d2f9a2b7e400000000132f29587f03dcbe82a3ba42a35219790fb76104e129ee37c5161893d873b4a1db25da36005d859ad7bd65ec10d3bca421cbcf7899c86c703d363ebc55e4ef0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6D027621-A285-11EE-A2F4-C2500A176F17} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 605fa7589236da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000004877772d9041bcac0653f7cad72a3ee380df303a50f2685bc846b86fc94c2c66000000000e80000000020000200000000ba6b0b9b8dd4fbba9b2c7ab84aecddc25a303a930ed8ed86efb8cf73187b56390000000f7aa18e8e44b2db31d3bf02e2aef0f25bc6d7d6828d33e12ba5e72ba7f55fef137e9ffeedde632954dd43df0ead58da5e7efeeae6983cd610d809cb5205b7df438400cdd547f2b237f7ca42689b8edb0cf78dd5376370a059ac682185db62a2e970bd4f45fc7b9a59b6115a19f82dc54a3b641b27ba2f73fe9632caba62d7e8dbe6558b15fca434bca65fc0a333db3ff40000000075207982e2d123b8c95dfcca34f7c10edb1fd3d1a8c66f25cf9defcfdf403fdab8414e4a85c29065fe434c1bc7bf51d44189b84382d88a31c19546ed8f5b18c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1960	2228	iexplore.exe	28
PID 2228 wrote to memory of 1960	2228	iexplore.exe	28
PID 2228 wrote to memory of 1960	2228	iexplore.exe	28
PID 2228 wrote to memory of 1960	2228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04f33087c533442bbb5fa0977b3aae51.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
555346539f49bb52a8b588fee786e10f

SHA1
0784fa527be749562027654bae1eba4e6f9a58c6

SHA256
890b9b649ae2826cb0ab4f10667a63e44d21d511eec8b35510eab7c894d474d2

SHA512
99a46e44f4166e2b6083cf36b59b6f23dd55a261c7944e0f1f84325209f55c2a2801847325c49ab5b7629455054f53a1f0a16f429dd96471e35ccb90355c5f1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c240f4e62798c170b140f6c560faf211

SHA1
52e558b0b9e9426455a744073faea0773c5ffec9

SHA256
8efc428a5934e4e74efeb0b55ea76c7d4e867d50753aa53619cb9ab04580681d

SHA512
796468ea2ce960a22b7b6833bd9ca6be13997a7050d1723440181df768b2493f0faef9fc235b184dae79f3339d197aa3de253dc49678c7a05709ffb3a0c1c4cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0fd40273acfa29f2dc978281bca18ce

SHA1
d106c06560dca2dfe18c3af8a97e6d259acc16ad

SHA256
72268e7d864dbeaad31ed8ec126a3af7afd4a30c97ee4033691e62664991a0a1

SHA512
8144444660e04417ad0c28ad84d3dd571aeac76bebfd90d1e4c635509fe1adc5760769f49207637592d06b1617e1f21b55ff3be676b01a1674053014c3327ca5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c2edbf38680a088c7fa505646a3dce9

SHA1
6a05abcd27c5ba296f427ec391c3e1e2086367cb

SHA256
cdb8f45a70c832d99efa904d02b3fb9b64ae9dd85f8b4e9927a98a8e29b20c4e

SHA512
622598759e1dc678cce6ffa5906e6a4c1ea71c7a4443bc26ef264c05d5e17b4d1c8e6144f6ec1951424c56472f9b3ee4f6255bc5ee2e10488bc245277796822f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43ed03cfce097229461467685b893d48

SHA1
335775b9dedabb3f6e1f64f8eb120b22b4af1c07

SHA256
3793aacd6085e51607c186dcb095f0ee02f15885bf0377df39e1d4dfc7ce35df

SHA512
100ba0b7665d4bcbe5b922eb7fe5fecbaf7a6941b01a2ab3ce593f138bbd328986405d451fbb362c4e085f023c855fb62bb7a68bebed2f33598fab95e475b2ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5e5f14e936fc7f93503b081a646197f

SHA1
5d7798635049f21ab24e4c322505ecb6c899b53d

SHA256
85b8f4f67bd15b6fba809fa30f4260e2d95faea2888a2582589d8f354fab783a

SHA512
0152a429c3b8e19acda9244297147611bf768deef6a9b9c9a193d3eeef70324ed07e45c020f07523e5bf079fa5fc9ce62041e76aa092ccb5c11e334fba9acdad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b25041fac22696a6c974af5d074944fa

SHA1
ee0fbeffa760c898a1d5427fe0354095cecacd23

SHA256
0f90b3f2f7e4e6c4ff8fa91fcb07e717b8afe458ba82030999b9a8ca669ecb89

SHA512
76f41aa6027e0783e26db775de27c4edbcc72374f16138b72ad3806c53b0240c240136a9fa995fcb03b36cba5db7c380572385bb0d3f4d453c0eb9e68f6ff1df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2669ff54f56a80a36dc35514f0601888

SHA1
c8c450dc5707f35744399928215d86ecdf963b5f

SHA256
e11e481501d6e58229758a6cd3cfbfec06f61acf8bbaa9df585c953f624a9710

SHA512
a264907ac075c4760b841c277cd202124a9809f4aea24bbdfb3e0ba96dbe739af234ba1dddb58721373c957132387bceaef965276e033ae69364ce1181526fcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57fd9b05b04195a46e0efeac05fabada

SHA1
1bd145d58684ace9eccae10d17f570586dc673ce

SHA256
cd5602c6a63b7aa73afdcb6e617eca9d4902542be0504315c4a4a670092fde73

SHA512
0a7f9ba1873e2231ea5b3ecebe54ff0388cb6e804cf96598f7e1611d1879428c9e1d45c9ca4ef6ec4b3f1019e0a37ba3cb2c46ba115000d4875339df5ad6ef90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60bef199edc0b2a70de37a662de5c729

SHA1
b429d2c950e6231a5ca2ee49da208da4b57546c7

SHA256
544063d1e48bf6e7dbb9974a425c86ff13a1ca1be223ed54db537ce49f49691c

SHA512
9efb05183eac31e2d80019c368864c6f61133b4eda305f4b1816c45728389c5db3eebfb6bf3939a5127a29f3a4a83296bfae4ccec13a8ed7a02456034e1e0996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efe57b04a5a62f6e003a41acafe2e799

SHA1
5acfa1368a7bf1951cd7b065fb1cf4661a5ca8da

SHA256
6b29eefb8bf6921020a80263bafe040ff17b0ce8e16977854fb61e2f93769ab5

SHA512
9490149eed11da92e8fb272ffcd1a52900aacc45c12a9850af42eadd930dd285e86cfec1d49b3b6727b2fa18307c6e7eed6913e9d32da9df8261dc551ed0745c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\f[1].txt

Filesize
34KB

MD5
000fb5d4f86565fba8bc1e034190f9a6

SHA1
2b72579e49cabdf6a8bf7a2faae78bc48a9b3766

SHA256
301f5751679186ae336f970079c352511c9e02b75c3da1f62677979e900a8f18

SHA512
3b75598a37bb47d44541c5e9d8064fe9805268ff2ebe16be5fb1e8af45e12674d1564b4de24d515522a28802ed3842cacb125aaa921df3b89d03c165148194c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabABBE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8567.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit