e57a3305017ce83fb467e233a617b0958aee8cb09d2dc71f134be0ae5b54b027

Analysis

max time kernel
152s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08f6db992fac0c6394cab216d8a57f59.html
Size

53KB
MD5

08f6db992fac0c6394cab216d8a57f59
SHA1

29f53811f25e7407cc15a2af147b7be027efda3e
SHA256

e57a3305017ce83fb467e233a617b0958aee8cb09d2dc71f134be0ae5b54b027
SHA512

671c8301bc4ce12fd8d9a4c11441b4dedd8dc2f945e7dc79478bdf22c738496af592e275456b8c8e12ca2bcc9df661708048321514aa916fed5a5e6e8c870c3e
SSDEEP

1536:CkgUiIakTqGivi+PyUarunlY863Nj+q5VyvR0w2AzTICbbGo5/t9M/dNwIUTDmDV:CkgUiIakTqGivi+PyUarunlY863Nj+qT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC051D11-A29A-11EE-A0A1-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409611521"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000060c3bd8e7433fc7c2e43dd9f1d87c998ad5aafbcf933abf0caa7329b0fcb78ad000000000e800000000200002000000058a5b8f2b4d651ac1aba9e11b2f689f200129d51e6fcdc17d005345f2063283e200000004daa82a1a2e59672102e81f418598968983ca75010eb5d8ee224c8fc2b2305dc40000000d27990f164c967b114dd2b62aa1f0f7ab2c67c1bac471617f8f5f42a618edf432eff5ce5ea0fba884c6fdc62cab249d7e1b82c14f7bea7fdf364e176cb968024	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 704af2dea736da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000006a90a5099711df47d8919c7d6f6cf744696ca3e3baff986fdd22d8b5b2ad479e000000000e80000000020000200000003fdb266c657f22bd7e3b8187e93da16dd98100ec2bc842ff5d17785a0a946f2790000000274ccdc07f53bfa435fa89abac520bdfcfdf4a51d1a0e5aa7819de7d65250888125d5c2190211e4c7400131b5135797824773fb110550188315cb0b1a26780f07ee81ce40b80b9d671dab20d0bd76f8cfb4b9f4b882eb85b20acd0d938da5e0ad09041a939e1272464ea468c73cfb67976ee62e38be782f4e3f1291e4b856fad7b245eac3c136451c356aea5faff272d40000000a1807e9c45986d97614081499b8158ca13e03afd634ea1ed77da998914470eea846820a26268e01453a385aecf8fc7fbd15cceec49e8de5d7c47982487a36288	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2804	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2804	iexplore.exe
2804	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2696	2804	iexplore.exe	30
PID 2804 wrote to memory of 2696	2804	iexplore.exe	30
PID 2804 wrote to memory of 2696	2804	iexplore.exe	30
PID 2804 wrote to memory of 2696	2804	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\08f6db992fac0c6394cab216d8a57f59.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c2a377d06360d4ada7c5ed6c46273c5

SHA1
114e667e797649d5dc7a6e091e6a53218215d527

SHA256
a58e3fb6a2ae57cde501227d8a8b02ae3d893ef7c0e1096023da5fd49d0ba81c

SHA512
193c19f540511b2499612813779b93c885c5f204bc3e475c152ac499e683e869777d08caba128cb94f304d44d111f9341cc428c855aa0895b03d324b5cc872ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0812f33df31792f8dee7cbc1d6a22eae

SHA1
88a9de136dc5a3588dd337564b1f9428c04ba4de

SHA256
c483688a508719bc5b9c361bf4f6fcfc084dd330c36b2a7892d3847700083c59

SHA512
37e8022337d9d2bd0ab5e63502a05080d540ddad8f29872ff20e85156659a860c9defcbd44dd8fa0077881658fbfd6a4e4502c10a24033307400fce935037fd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8467ca6889ca6b272f6a5cdb7a53b578

SHA1
7d0a51f38b7f8a66481bc2e80e7b17b14a92b23d

SHA256
2c05fb91fb0ae47cb83b3a6ba0055cabee74d9f2c6609d56788aeeb31dc71641

SHA512
d33bf240bf5d1cd42c9648a85e85887277dabf5613c484700b0da38fddf75bd188047b81b5f8451dc0662f5d910abb944659370c4fc019d591b9f4b80c3e22cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be43943f2b5ad372441891619b9857c0

SHA1
67707281a0ca6d7ad7f28772740ee0a533b5802a

SHA256
4ae2bc476cbdf5fdaf3558474d3cba3899bf0a62008f83b7402ee7a0c16a9603

SHA512
c7c7bb8c03804385f2216f2ec934a404a095cdea500bf64ac69865bc045e8d6f96c197aaae557bbf431a6cd47ea4dd4574f06391906ed5701e9ed2b23effe628

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6147acd7b9ea5e59bb362511b4b21a5f

SHA1
41a96a7fcc61d8222843ddf87e60dbec435531d4

SHA256
58c673927a1a0b0923ccf2e847891205dab70a1cecd2acfb4236befb5b22bbdd

SHA512
dc9735bc3fa12c10384900f5c5debfc2c5ce01487ef7c1a168cbee489bb87f22ee6caa93f5ca3f34dcdfdb554bd2144d50dfa9c61108ca06ec242c77ab9f8982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e84f64cec2db7937af6ee63ffd668b72

SHA1
cbfc7ca0851142fa70ea4460971864cda9411ec9

SHA256
83323777054d6cfa626073685c153e06abc4d61b5d9525bf8001415298d7f2d4

SHA512
be11aa3cb511aadf3f1753d7aa45205bb81566aa80b99fffcfe722e1aab5bd7096f97fed179f208ae487abc52215837b59511ff0b6be3b6e4f7bb0c20da16c7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c3b1d14776b84b0b3cd48453b1d051e

SHA1
127b001d6ec7acc80bcc304abb62d2940b67afe3

SHA256
0f89708b103d04781d5c46659241b9cc399cbaef6c4512f937a8c30ac21f5c7a

SHA512
d28c646f712f652241e1e9bfb5cd9892fe40488ab6f0ac36a8eecf33256416ca867898cc53b0782f48dd57d07a4bced4e7708775ef90c6f5f63625f5ad20715a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4746abcd57be37778f2a5819e21e3f7

SHA1
c549df78f40f1ff34a8274da172644e832deec37

SHA256
2b054c29be84ecec11cf1d41cf69e1a59a84f308b18d07197819dd03c7478b32

SHA512
feb3e4b998f31286f53c641e4f70b9933cfde0b53c8168a3c723d06ae9217a1364c4ff318463337b0d6e970f27a10869a896c3be1e43cc2179ec5f25ff63692d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef29beb5c76c76503e8a92426e6672e4

SHA1
cd529d032d870ab78783a8a35d13265f75f6ec86

SHA256
ed62bc45963fdfedda3667b8c9c2ea231debf5d538739eb69454b3011eb730f3

SHA512
5d43da23898212e84f89230c95335d0296a27cd0b0dad0ed456572ffd83e75748fdf583e0ce7780349c1c9e8d7298eb6226df489885394f8f8c9dc0f9a450388

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d71e9c3702de49f88a75f3c2039d8a6

SHA1
edc1478a4112e72f06b361f561bb7036fb0379e6

SHA256
69b47429924f0c8f9bb2148414be9a46887b6a9b2ac112a170de4b78baa02b8d

SHA512
83383c2a6d42bf7acd1b0d334be4327887e8d8b6dde344be74124150e806a8b060fcd4068a703bb162753db3a799efbe56c2600092c105ee38921419f9d8f0dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4af47f2e943d22fc8e9ef7590a2c428d

SHA1
8258a05e913c860c8307f47de66e1c54fe500ec2

SHA256
d4795d347e9932a1de3f84fcafce7c0d1981c3227b8ab2aafa56dcc9ca7f9413

SHA512
37c86520e2a0aa51e6b07a2757a3d205b9efbd4e395da12134c5cb2f6577387cf6e0e9d51456db849ecb0bede600bb89e789d8763cf096d1f54152355aaa0dfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
327b48a9672d26add025c388e59a38a0

SHA1
5a6cd33e5f31aa56cba07484aaa0643a44b9133f

SHA256
0fa424bf250ff732db139ef50dd004036fe58fe3957fc36089fb66a3cc30a380

SHA512
27eabe1b72c7751530e695f7215b4aa14edcbe3f8b90d17387e0f0e79a0ad23a89e5f84d9000f706932d25c8614715de0dd48660ef50c31c66c94d0fed026708

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c54d0cccf4b9f6d91f585f007dec5138

SHA1
e77364a26da82bac5c71ee49f34ba7ed4f13c38d

SHA256
d275f676e472b31b48e7f9d3343dd1a8fbad3e96dbd1dc1c81f7e82e8e041b44

SHA512
fcaf3cffa72ea1f5f4b39ebf333a9f2339196905cdb17a386dd873ca1a9f403165c58df0b66b308854a0350028ffeba3c2bde83faf30ef0a7360a9b78261a1f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\topic_starter[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE0EE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE20B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit