e42a60856573cf054d4fdd7cec86c618032ae59ee3cbf79bafd55c43be5c9612

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c10e4e6e0d40b35e714ee3f19f2caef.html
Size

55KB
MD5

0c10e4e6e0d40b35e714ee3f19f2caef
SHA1

b6e0274dd4a19078f69cb37f7c51fadde96340dd
SHA256

e42a60856573cf054d4fdd7cec86c618032ae59ee3cbf79bafd55c43be5c9612
SHA512

a3e105a6f5d926ede92d71e839eb4cced0c9fb9129025821f42a41ab24f3bcb3e987c22251a74f542eb078c5fca843ec07640260eff14272c4af2b172fcc29f9
SSDEEP

768:1tVBREyTOb16L34N5B1uTVNY9SWjSaqPE4VASalznOn9gnVnRnTnV9Kihr50pTme:BEyWoz6TO9ANZzX1hr50pqe

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000002d3a293f96805c161ae59f4e2cd43281e907f8718d4e61c67a1d546bebe1c02a000000000e80000000020000200000001ff6912a7483b4465a233df120d8c2769d8151a2d87031de1226cfc4576351a2900000008e3a849a9b1c2155944a0b19ad04df62d06a42669fa6fa5f41f10a38a0f0c1bfccdb8d29060ab806bda88212b21270a24925c667263fd28d548459b4052f8e5131de5b4871668b659dea7b45962aad778581a3d2614aff472807ba43973aa1e85b5d1f554e9457db6e42918f37ed06f7afebec31e32a95f69ab5b230e7192604bdd619f078e36f190e3f9fb3414442fe400000000f22675cf7df9778fdb8e12609db60fc0f52b388fbb353319b79b971b751a5a689c34d58a81a319bd787f46fee4aa0b0c3cbf0625bd5004b325205736dcfe094	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409653142"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e782990837da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000008df6e098f73ccb1b37d4970e5824b230efcf00fc067292d0558f55509f29b11000000000e8000000002000020000000fd276c41627de8fbb9b13d319a64730dc8b7a371fdd0458167372441fab5c4f32000000024c94545da73194ca0914798f7b078708251ebab8b7f143ae12e5a107c02dee3400000008ff8a771c636fb755cefd1efa6677a6eae37aed13f6733401f3fca2c02ceb5a6e4d62323b16efc453eda47e1c205e2b3d73a9f5145f942936cc2e35377dc6029	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6DDBC21-A2FB-11EE-B2C4-F6BE0C79E4FA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2616	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2616	iexplore.exe
2616	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2640	2616	iexplore.exe	17
PID 2616 wrote to memory of 2640	2616	iexplore.exe	17
PID 2616 wrote to memory of 2640	2616	iexplore.exe	17
PID 2616 wrote to memory of 2640	2616	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c10e4e6e0d40b35e714ee3f19f2caef.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2616 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6badb762c8edb1517cfe3682e5b2dda5

SHA1
f90972cd2cdd79c834a16946cbc6ad1d2b75f108

SHA256
ebe00e3035f5ba316077923f23bf00c860a63cf7efc85ecdf375abe42d302498

SHA512
27eff3f592736980f990253e1cadb9f7ee35536d26f74d46c60d2cfef95826636ac70f768361e2c6b260be4c8f388535e600abbe0180c593d77fb64f15bcc947

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a94c7c07d6773192430287fb46b4a04

SHA1
0985b7e54d895762798eb0383931d5f8eb09f403

SHA256
dbfe6d2e17caf9146c32338e5e230e0a96e51b74eed5bb53c3514e73ccf6a235

SHA512
77c16ab63072bba2fc06e4676e406976b68b0dfe1dac3df6b5b69b4fa0cc11ae15fc8cb442f3238e978be0e2f8c5ce1ddfa987b2aa1212a5984e55e263cd07ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bde0b374b89049c25d7bd130aebf50f0

SHA1
8353fa5522fa4ebed50cd80ec291f8641c8ccb1e

SHA256
9af805e3dce5da0ef93c580efd1038af8714b4fa56db09746651ceaff64963a1

SHA512
388ffefbc7bc6276a05bfa95942861dec37099a36bc0df121bd1a8f6e010639390d8ae5239ca3a5fc611f8fd7c0d83640095428f3d1c49a3a3ca06d0f1363714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7395fd009a7dd2100b73077c4c3fb31d

SHA1
c2590c96969a02e87d67b3922c721bcf7ea2c0db

SHA256
37c0d49d672078018132ad650c9039304926114d2db2663a4fbb081f9966fbd9

SHA512
0f7ed141eb135549d71cb163a28f81c0d5c4938d936a037a6c07a7d73fa677c583602ea2178a7c90da3b0b95051116fa76766f8190c02f587eba7aad6e39f78f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fb9b5aa370e157c5e5c16a3b75e054b

SHA1
e95dd5aa345ebbea0f2d58b3a3b6d5d21520cfa0

SHA256
43561975478c3c27fb474a62d0d609fb83a77eb48ff21d07c3b333709890cd48

SHA512
9bd963a5c9c719e868a059f06227a5178a9d7fe19157ace0fb149e2466f10ba5e01ca97a00e9bedca8018aef7c6d7456e293d690d8163ff5bd68460994592662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81e54522cda972414e7aff8c59b6c661

SHA1
16f9db43ebb90abb7a658ffaf02b684417f019c6

SHA256
94f731d4c90915a4de8bcdc07e952ae399598112dcc9fe5e2f0d37cb7525e792

SHA512
3afc1069b8d9b74d11a5fe0333d2af8abad7356f2dc304bbd8d587ce8359820a48c8ebcca7da7b5d54fda700bc0765ce9a58b06d888ede859b0ac07ac9fc80b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e749a1bfc1f9391e21a3a0815113508c

SHA1
f53512aeb3662bd1398bed4de2b8c0af487300ba

SHA256
f298a4f71b59d7987f6254d6e2b9ddc10e584502863d5418f822db52d51a3404

SHA512
347677747f8bf1f8a46f8a14262a55bdca7f69ea9d3876e7f158f2437d216d28f2b2b9b11f1e6af8db5fc44c70ed3a2582af70e00fe749ba77a663d9995d513b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
937c8e2754c20356b89f96ef1e8334b8

SHA1
7619693fb0b3aa63ec08c208c14e37c9c252a963

SHA256
5bf5a0f8cb45569eaeffed380c4ca049a3655723f22314182fa8f5e51d2821ab

SHA512
433a628609bed5214200c6bc0e847ccaa84b501d0bb20cc6289921724fe76e762887cfd82bec9588969b80486eb657f7014e5405ce8fcaf93a423d9d12f3bea1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cff408ee61262722d5c753dd2aca3a28

SHA1
46317de9cbf5be878f11c88b735fd617319f9674

SHA256
273c044d30876cbbb5ddc7596e7680e4fb28528219b38981f42b8aa0df9dce1f

SHA512
0d0a69be5a79dfda11172703efa2e203e6d76867882217302fb8e1a32e18a5e3172af20dba77d5261a208e27657fbe5a7bbf94c5821268e5dd85258a530e15cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eaba6a1f8234265a8549749d15229f3

SHA1
3fa80b688a4fb603a4c373bab2d687d0deb3297f

SHA256
ed7cdceca57197290e6a62cb227b85f9a199186f9f1e4047173e7f2acd16e333

SHA512
08048274994426b2637fa90fd6c7ab4855101e37626775f8a180801f61678a1dca01a0ea52d276edaf033073e1f9f2ecbe8e75974bc88df26d8d104a19c7b369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9193877c0049d1221f6a8848a583300d

SHA1
30a3d58543320d5a60da90a0adde985ee01a3f03

SHA256
74defaef5ec12856800e1b0b487978ac30ddd3938c9c50de985531107ce11f78

SHA512
a4c052a768dc3dbd72debb9e85de1d62284145480943f7ea4fa16d972f8609ce75bb876486bf41d391d46863eed64f51bab2521ddfd4ba9132d7b6ba4e6333f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42275ce15f9d09cb5d21edf0d3d7c5b2

SHA1
47bbd528e97841f41349b087fa4eb2b6afa4c638

SHA256
bcb9c98ef308cb896b3191c46d66bc9f7d8284fb9d87b744fd0fddd5f66492d1

SHA512
2f0c221f3db6a62cbf073212b2aec3fec95f4fbc25078161dc04da771647013500d823a8017373afa942179810fdff240623e36b7f5a2624b61d0b1c61de17aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a12355f24242f20b1b2652fc82638be4

SHA1
9a6638ca4241469cd6a51aafe1a9bfebb769c197

SHA256
dc9e24593972a1aaed298ef5394766bf503a422feff88bfbafd33655c37e4b74

SHA512
0efa9f056a8901d2b7fb47881aa7d3f3cea4846a1b490b3404fb2d7e94c0653665a4af81351ea5d663768aaa23416088b31fab8926d7c82d717da12f5fbe317e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1da66434d5a0f2a39e7853c07a64a13c

SHA1
88c0949260841717451cf3bb6e384a0b4dc23f4c

SHA256
43b48625847a1e5077f3f0ea9ffa22ff334dce7abc1f63874033b7bd2573cd70

SHA512
2b69523a6d8158496e71ee215aac1984ddf7f7fddba490457d3bb8f8bf680cef82479aba80f47c4785ad4cda170d77c0503a1a7649288ae850bcbc1d6bc6ff09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c0a59a89575198e96a3b0e83e919810

SHA1
104a2a99596c8a89c6b9bd8d82a6af384a2306ba

SHA256
1a5cf67a4f8bc274ce4174b4c8b6e38ddd910bad0b6a41ecc6d6e3dd6d714539

SHA512
80cbde85983ad90b6f73ec7956d6e5429c5016d9ff5fde494c1137e3545ba05ffb3bd7517f9c3a767f3266a901184036d023aaac610fab32a01a8f31f05ff155

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4AE7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4AFA.tmp

Filesize
74KB

MD5
573a1613342003441ec69a142b927f9c

SHA1
78d9830c9e2a50a4e619cb2f09670316acfcdc9f

SHA256
4cea3febf2962f6652dfc9dffe45127ea246db9ddec463290175f4df59cb1508

SHA512
6db365e6e75c9ce19027082c007f77f620e49b6dd14c1c7d1f734d7a7144fcb98cb3ac9c61f0fe9018368c0df9f9a16e7ff33a959548f709e159fcfbf2ae4930

Download Submit