e61e626e9bcfc3f8d509dc86b1a7df5f89b2c34c6cb1bfa648967e1f4f494be7

Analysis

max time kernel
120s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

10364a862d5bc6704c6da13bff93c5e5.html
Size

48KB
MD5

10364a862d5bc6704c6da13bff93c5e5
SHA1

7662f7f245d944ae3534913dc901e4ea19b04d96
SHA256

e61e626e9bcfc3f8d509dc86b1a7df5f89b2c34c6cb1bfa648967e1f4f494be7
SHA512

fc6b3f8e2be99dc92cf24f25b704826a9551b262854fa56d4d8ce6e4c36a6644f07ec1f782dbb26e6ec47f91f52ae34287c90d5bcd5025b39f76fe909662fd6e
SSDEEP

1536:mSHSSSlgoEbTsBp0MLOyiAzWzT8pfPn2dHfU:+lnlJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e6ade2c72e44e22b6fad12b3e0fb0e0c60d27c0d8022eea6eb3562f5a46914d9000000000e8000000002000020000000e6e6ea7ce12e9a027e876cbdc1a8043d81231912fc8535b3c1fcbd49280e8f9090000000d0abfd3b6059d26aec4c4c43c47d75358049b5fa0bd4f5a852c34c40be7e3270ca411f9a856c15a90b64850a3a69725e3605c58778b6763785b291d3d8fa6046a08f727dba58170be40461763de693d8d6d716a759e30d6bcd58a8754ac8d970bfb9d7e882a91bce896c74cfc015544cf4d47e48906cb429f005d8ffc46f1712a5b74d8a4baffd4d91360ebf7f4a6a99400000007b284f71a5455442994ee8b292c035849bf1c6e4f1f7dbaa921d8133ae145a0a326e143b49abae419258477d9232bb3d071ba4e1a968f1ea3d497592de555cbe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409627344"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0D16C01-A2BF-11EE-9D0D-D2016227024C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f03b5fa9cc36da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000efefce0eb61137d01ca1c25fea9a64f647acd570c61edb8dba89559eefc5dea9000000000e80000000020000200000007888688c7411c508524f79474b51921c4e7214de8b47592e278b43926c7357b820000000e2c4bf88f2162327dbea5933fdd328ce9da86b22cd2db63a8c1cbb28cd5a5371400000001e14782fc0caef1c1abc7ce5232072aa79a205b51d3ebcb651bb44504d20c280d5e5fba3fcba87dbf36f70ee40bed70c5d545ba83e8bd91d923a6d5dbe933d19	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2852	iexplore.exe
2852	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2436	2852	iexplore.exe	28
PID 2852 wrote to memory of 2436	2852	iexplore.exe	28
PID 2852 wrote to memory of 2436	2852	iexplore.exe	28
PID 2852 wrote to memory of 2436	2852	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10364a862d5bc6704c6da13bff93c5e5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db870350e1af88ddac52ae0912679325

SHA1
5d51d5b0c8617084af98ba04a7836ca431cb7c22

SHA256
067e067bb9822dce3c66a1a5a4c1a84d430ed7bd168140b82a743f114040fa19

SHA512
f9cac65c40b603a1433794a838e5cd928bf0a48df126ebc06ea5fbe95cfefa338533375e401c0faa57f6a29e0d5571b77116d13aab4700ee95c9d21c88a116b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b6fcc238fa1831aecfd1b031c6c2914

SHA1
6c4d8355c806eaae4ecd40035080867891ff13e3

SHA256
caf0b5d78b88c6d018fcacc3e1af08af78b290cae9c015cd7ab58d12f4af432b

SHA512
fed9717db0d6a837176a139a54a87bf15e1baacf430b544bf49e27f3a06a55fb1853f3269945b63bdb3028e8e01e15291d430283b69027bc3e02f3d987b8927a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d511055b905aaa2f71771cc10851a733

SHA1
fbe6904d69396f2822aac79e557c4b8b1f251767

SHA256
30034eecc4119facb73a650aa3fefacdd330f2f3ac74c20e42280f7692ddf2d1

SHA512
2acc0e789a92a388f31a1d6b67f8df3f244bbdfea23278016f4b32603e28b5d8fa3428e490facc17388c710d26726b135b5c92b740818c489bf8dc29e6a0063b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43fe6cb046566f32dbd33060daa4db25

SHA1
43fa5a3c6df1fc4cecd41351a7dd1b797a6e5895

SHA256
99ad2aab32d11f919ea46953073857bba2d5cbc723445bba5eb4f1303c92c44a

SHA512
9c9e1a45f8ec80fd542b024264d05a4f99a1638164bcff33c438dca38b3d1d3a92bd1d309439520a5f49b0f4fa98457384dea8ec728aae1efeebb49d59e3463b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
143b6278fc9f1adf8af7c149e4841a95

SHA1
2a5d307b91d8d5738c5a91f42a7621eaeebbec69

SHA256
85e3cf9d99cade1b6148cb477b9f652fa9cf21263f763ff83574dd49941cd2cf

SHA512
d109cd27361eca6d805fd884ace598c322d81e0248c3854df118f029898d39cbfe0f65436d41d718d7c674e72c90be46b2e16e9a4e10ac88debe91dda1bf6e7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54a21516c33937ec0df200d196547057

SHA1
86a34efa884f68834bc9d487e415c43ccdf495cd

SHA256
773cf30cf9421a86e05d7e486e69fa5579df2734930d4aeb1f3492bc215f76b2

SHA512
8cc6c8856f068f9a7731f438248d504f21a3da0abb1e0a002695ec0ce70c6578ad3493be274c5d4f2954298de04ca1235d0e85221a57b958092f9dce0edfabb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59346e7fe1b8e2fdc461e1abf2d4a8ed

SHA1
7c1575c345efda8d82b423ae80b4fdc881610ce3

SHA256
a6091d06537238e239de93937edc4bb78a756c2af7692692a9597b0eb077a834

SHA512
f78b1a1bc44f475bd159f6adb63f0dd834b2bd91aefa1a6f380a1825536b9cbab2a865dd744b4d00e9143ffcaea4bb8608694cf2207ac8cee952d4b789dcb4ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a27be2b009a6147e16d450eac0d64f73

SHA1
5da592369113ab3482fa08a225f6c9eda3561b71

SHA256
c58e12d37b85a0935c0774b333ded20e308778b901f17b5620310172e5591eee

SHA512
6e3986db814372ab61b3626273e561d9266ae323ad82928e2c40414ee2da6157f14e539e6a699707b3c4ff84dea810c1429a0faa5909a14960277d2348c3293e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b482d59f21d0811f0a596e24ab785ef0

SHA1
b1407e0ca7f5d17fc58f9e8a7e9697438ee371bc

SHA256
4f76017d11027cbe4d70c4021a1f918a02617d833a35ef3decf3033e5494dfff

SHA512
fbb046cb30b2b63070ded606192f816f81f16e0607131b0b740cf0b004538765cff35ecb69c465a627f569660b86d58b7b5ce8a297d21ab249b3ce4c66997ff4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aad107f5965ffd106c1173295672aafb

SHA1
61db09a8d43310838e875a60867426c605ce628b

SHA256
7e067f0ae4861fee1d2c30b0fda14f93f622c4dd67bcba50e593e8a45e61bbe7

SHA512
9432bccaab4702950b5c302e1257e63e0309ea2ecc7d5d7fd5fd67503af8679e17e92a4e7749a9701a190524c58d9b7c3b9a96e5ff1c2823f791793018b12abd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b3cb7bb87bc4023fe324192028f9a2a

SHA1
4287c98862aef7fe4372c1132f93529dfaaee711

SHA256
b0ac4b6294c5d21573c1f2d673bb20c5a24b69ad7dc780094227373dc4527b78

SHA512
cfbc7477cada347b9ac871fecb31cea949ab5bc1da46f59efc150e18775bf2ca7e8c5b71fee1f586bd8d4c09e8b1179bc0520906e3d2736ca7ace5d992a543e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6F28.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7064.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit