e1b911ead9d0f5663a84535f3ebd06edaba47efb030d56d7ad540bf4c208e6c5

Analysis

max time kernel
121s
max time network
139s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04fc6c4be2ac889edb5eddd09a142e1d.html
Size

6KB
MD5

04fc6c4be2ac889edb5eddd09a142e1d
SHA1

d44dc335cfd1815db31baa3a8efb0a799a1a9151
SHA256

e1b911ead9d0f5663a84535f3ebd06edaba47efb030d56d7ad540bf4c208e6c5
SHA512

7f3ceb23bf620f74f505edd3bba2fbb37b90c5d7f32341c6febad4fd4abed3c34a835afb5c1a73d81749293c6e640baa663514d79e12f1068f8a547b4319f4fa
SSDEEP

96:uzVs+ux7x3iLLY1k9o84d12ef7CSTUoZcEZ7ru7f:csz7x3iAYS/jb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409602433"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 404eb58f9236da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4D41CB1-A285-11EE-9DE3-E6B549E8BD88} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000038c6fceb869722650255513b9010d8e5999a26c4a93edd8cf5ded3f90b4bce15000000000e800000000200002000000066095cf120fbec908bcbe9a2bbb5fe072a417c811bae91729248ed02b5bf10fd200000008f652502982c6ac7679fb47e024e66e6d510a1c20aa7663a4f43a05c6453b80b4000000047fdc0f056da5084e3175797a30e0325aa081c0d49afab433ba695cc5e5e0c8d804b6e50e939d0a1accd1adcd52d7fa75ef2dd81fd0c4ca00818d48cf6c6027f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000d035678440284108327d22258b33ae1e51ecae4b96a0e308f28ac833b1d030a7000000000e8000000002000020000000c79d298301d9c5f7625d402863737d63d30eb1b4474f5c1868df5e6ba29de92590000000805eb00da735eabf3006bdb4ba5e53b1a4331f9fcebc7cfeb0773cf6254d46f7054cd97a0d02c57877bb81c144c76f3bcbe44fe87d3d29bffd1b0efc649f2467b7b4ff996ac5a748ee70e38ac75c81b65fb0748d349a8084b8367a6788ef8e08a6b046eb5998961f5defaaab422a219f5064d1944b7c1fc49fb28a5dbb6a29dcc049be9b14394d0d85ca2309d46dba514000000013f267030ea9af9ec3e5eaf474858ef2ce7f8fc0994568d804cfe36231b796f088c6f7c3f031cc9a0329143a2522d172becadadfb593cb3d1c62260c7ffd38d5	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2952	iexplore.exe
2952	iexplore.exe
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2176	2952	iexplore.exe	17
PID 2952 wrote to memory of 2176	2952	iexplore.exe	17
PID 2952 wrote to memory of 2176	2952	iexplore.exe	17
PID 2952 wrote to memory of 2176	2952	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04fc6c4be2ac889edb5eddd09a142e1d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
208ff706229da955b78efd7993f91761

SHA1
baa1cee5b26bb5f5171496738507c11fa090db71

SHA256
fa62586c85f958ca938aaee08103a786f3d7ce3a92d360f17c20d215f1f57290

SHA512
fdaf65a2fc5ed039bcf13565c0cd5862a85697ba104d7b159ec87a491ea8e989a4125aee80b42c659dd1e6bb05a0ec3c7a2cbcfe4ae5cb85931523917a220edd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f47dfc7e9381522bbc6900cfc8d175e

SHA1
659c40326774a98695836cf72f23c7bf1cdf4e24

SHA256
9e94053f41d380d47802e12d3f7e620f28cf7fe88d54b668a6c263beed431a1b

SHA512
3a84f73897ccee441b1d33835c015f58a1e535a2ea13752dbdc8dac221a672d0b431efe02a8236c02686ea5003bf19b75214fd6757325f36c61883070438f2c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32c9638725b5182f987dc8f002a24216

SHA1
2ad47ccb7a5327fbd34a29f423d87f49cd269f1f

SHA256
524f8033a5e8f17e1babd80866c1191feaa22d776b122b15dfdcefa64dc97364

SHA512
5a8aa3ae051542234e25be4999bbfd4511d2fe3413d1d1c5769f3f530640db3acdb57a7b6f45baf66efe46e86d652a19b7b7128b99b094b9af13cbc280d53376

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec72352ac31ff60c21b4bc4623b2e642

SHA1
48b2d2454d818acefba81fcfddc34394b3f730c6

SHA256
d9cc07b4ed061625279b900060a69a9d7c895cea8d9c83a51d038b90ecdbbf04

SHA512
c465f037432651b21c4484c13b84d284c3a1b939a15684af9a7e670a1cf71288f10d8864bcc12add0ad334b5be1cd7053d69a497d245f26ab398bc3688b68632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e7558747a6ab1113f43c5d16371a000

SHA1
76f84bcdd8b6bf84c8ae3b8683a74e40755207f5

SHA256
e0648416435890072abf1a445ca480e428806acf21ca077c2d9039071940cc41

SHA512
caaf3c79cee66e5152b58ee661ae683cf049856ab5133e823884f68589ba48f16d3db5835ead8ab296120349ad70020235651f2249a8c154464ccae56d466692

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32a2d27c36c21f8a449045d700a96d7c

SHA1
4c902a2873f741dccd01de82395e3383ee84adae

SHA256
3ac6e40ceec5ea65d7b61c287f0e2319bb95e2b5666f1e1f0a6a5f5fcb4ef91c

SHA512
605d379d6190870a5daf6940f31860429bec67df35dbafcbe7da236090b5bc2a804ec469217f9728f48b3b28b4ac3084115a499c858339c8793a81a0dc1200df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97e0edab8e3b21965b46b10c77713ad4

SHA1
7b77e666ae416e982beb31e20ba904984e41fbad

SHA256
9ebf2c6d1ecc60634f31313a5d0e9a01d77fb7f31aa4ea922a9723f1ac24c7a1

SHA512
030e3b41c6e7969247708c5e23547cd10fa870070c84a3fd14b483e28aebc03e7f5207e59110267880619235a064e25f0d90065974a9535e02b6495986600d0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30ee629116b61177a44462e7de77a081

SHA1
8087625ebd7c1d8c3d6fe5066bd2106fe274a778

SHA256
21d8b8e435821c3cf8ac57a8c349e768fd96eed6b857d3ddf2efdad1001537a5

SHA512
4e03d2c6012215b4974615490263f26e371a93e7596f79571162a0487003ced9d71c8b507113d0988ab36cfd1cebf5650603d6c4a7fe9717bec4263ec2225541

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6f5a3c39a9fa3ed1717d5dc22456299

SHA1
86fbf3069ba08a16ee91f4a510d62eb6850a7b25

SHA256
afdcba4a889482bb373a2c53e4c4366c9e412830710fe434acb449088400c55e

SHA512
fc51a166109cc83613481deadf92da57b19975761d7aff1b2f176b43b42ccfa3476add32c9324e7a33ef3f5d508c754879be27b612e7ad1f7e03bc44e91a621f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6c72ea30110fca45f1ab17c2df4e397

SHA1
972a685c56bf7a56bed229d49f2df7a414fa7e34

SHA256
16ee9be049a18e5d0e42e649edb9f78577f90922e772f16258f12de6d8e01459

SHA512
1b5d6e5482c7acf62f90ee46a1480bfde40a4d8b747021d61cff92c7827dff76fcc9df5fcbe1b3b7356f68912c6d9aaeabff0d2c6f39f0f1a32de3f0d8b1f949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
def4a82a1495b95bedc3d9ca29f72001

SHA1
985ca008429c8c9021a9e87d770760b1283ed76c

SHA256
b669b9317c5fb16db407ed8e0980d55016d3153cd79c233696c05a2c3d48bbe2

SHA512
6cf74bc3b1919503d0ab9d31d2dd376d1d5701829a680ec5026286fc53345522c85964543a45f6187ab9826ac71f0472c2524d3194a47638c4055555944e66f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82deaf462010a5f1fb5d08f80a860514

SHA1
35c48df08d3ca1aa377d7b357bc1bcb0f13a9cac

SHA256
3306e44e31abccf4951dd32cf03dd1f787a277114a196c708f092698c518f50e

SHA512
d4b9fdd917acac2d199d5dd2c5a602b289a353bf49a04d4ee2a85f54415f1015078eea756147f06b138cc1b0be2130111075280c0632401f9ea6c053dccfb86a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e1c62233a5b305a2a279ed8236d52d6a

SHA1
51c650648233416899f42c5f02ed0db0e3bf4086

SHA256
24b1b46b53e148a2f10118d1bfc095c63cbce2b0006591ee2abb12fec9ca0ea7

SHA512
1aa69a56d2bcb92713b1c2ca5fb8e454ff4097476eebaa28b81409cc52f32ec6b60936f295561b6b01f557e94ffb3a7ffcb15240bd6f6e575d6756bc7408c5b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7C67.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit