e55e2838b41662b6cb603ea8b9147337ec0e0286f22f0fef10a8ad6bbde03fd2

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1089514c7c4c08c4d241b30301ff0189.html
Size

53KB
MD5

1089514c7c4c08c4d241b30301ff0189
SHA1

ffe3fb327bef199a49a05f91a09ec0dcfe9ca3da
SHA256

e55e2838b41662b6cb603ea8b9147337ec0e0286f22f0fef10a8ad6bbde03fd2
SHA512

ad0105577b81482ebb97b16508ae51562eb9c36eb10d7c98016c9f545a9dc1ec6b53e36afad1b93da65205ea9a096ae18a622f1893e769b6f1fe0b5de523b622
SSDEEP

1536:CkgUiIakTqGivi+PyUjrunlY6o63Nj+q5Vy0R0w2AzTICbbtob8/t9M/dNwIUTD9:CkgUiIakTqGivi+PyUjrunlY6o63Nj+u

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409678454"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1EA5D01-A336-11EE-9AB8-F6F8CE09FCD4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000e40979bbc7b31c73e4bfc674e201eda1eea560afd1b16fce2bf5e3bbb0b79215000000000e80000000020000200000009022fcf339447858d61b9d079a2a12695901a8db3f4aeb3efc623799b1c62ae620000000288f7f6914ded26d57ed5c5603e83ef3c10b1fc73e1227433403a1d321679a2b4000000075accecb5b59c89a8a8035c65bd3b104f4a8316e167daf4b29b3c132cbce9eacc8608f9d5960844c6d470c7f95bf0ce6c9dbecb2e0c4b786b6c0db83f2eb682c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ae8b9b4337da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000275c44e58a9fbf609be0b43c6e9c476cba83c58f642f124a9daebb7115dc7b3e000000000e80000000020000200000009212a72b624dcb1a8df6a3198c31dc9d55b38e2535524009909442472625b3029000000086588a7be3f4417251875def56364acdb8476854e399a0084d4ec3d567e48fbbb138cb9cd67a71a676d1deecfc73b0a884363222a8dba37a2a3a5b5abf4496e466292844f285df6299e8f226427a71fcc5a4a0a0a96870aae27e0690fb6649509264bdce460ed6955244d90e943bd9b2d5ea61789ff5b5dd161789529e5657915a1f37076241ae85b0adc74fcd11fdc34000000099e492a02f88d4ac91acb478f71876ae3ad5731a7c4bd2452f986e4384f57bd46d4d565a226cedda58764c274c0bb93a62b19404036d59f2404c1dd51c624807	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2448	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2448	iexplore.exe
2448	iexplore.exe
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2440	2448	iexplore.exe	28
PID 2448 wrote to memory of 2440	2448	iexplore.exe	28
PID 2448 wrote to memory of 2440	2448	iexplore.exe	28
PID 2448 wrote to memory of 2440	2448	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1089514c7c4c08c4d241b30301ff0189.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2448 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
2571c758e8d0f0bf8f5d67bff298f8c5

SHA1
03e5f32b1df3192c03c3a7bb5835bcd25a910ae4

SHA256
8f1b567df7f2ef7db49c820b902aad11b432d3a0674ec4f09c41483c578fa1b1

SHA512
f2d563dbc953785160f01215a9739686ddf4f410121e06064e7c4473a75eb43c2be20e24dfa7c6fb723f68c33c71424b153dbbdb67083288ad8d2503b9b5b2ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf20d1fc2a5ac43feafbbf29dbfa76f3

SHA1
417d84a44a04ae808f41769453ad5c5523fd1a02

SHA256
d162ea5b33d249d442af006cb3c4348d47581fd1c0042e54a61e61be27e603a8

SHA512
52d0c57c6a36e4ca8e562dfec7fd4dfb90a96c8c1c1aca3c770353aa5e215d335b6ce8eabf50a2175f752cafe390a8da91d26bb029a3c0cb12bcf070e76e873e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32509733439c4f31d8e27cde2bacb262

SHA1
ca0b6c52ae824308852cacc42c5209577851d48c

SHA256
6d32e269e69aa51c8dd39dfd651d4d4454aa26cda05a8173feac3acbd6f7912b

SHA512
edf8b2508f4cf404bc08ba1181cd6ecd3ea7162f0a71556df7f27b78bd45cd3799370e7ca4d5818e9ba6d6a29fe1967f68564db0d5a0253251aa34a4c62ead61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
656f5c8582f33f52b488e32501cbf975

SHA1
c8a6cff6ace6ed7a1b7bd45602ac647b3aac29d8

SHA256
67852e5c41ee1a196e103509437eb516fdc7cfaff2cc648b897ceb16eb5063ae

SHA512
9125735b8d8b2502fa6305531d81954f4075757354c71cbf7290592deedc73bc93a988686371328712fd526379385ddd20f5d584a95af826f022d2c1e23f9a10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb669b2786c3a281545d5d2aec4513a1

SHA1
b0d626e7eb0c86c77c392fbd95e2247f48665476

SHA256
99411a4553038c201101c3f48bf5b6878518f8aaa5f48a12082f8529a7c33920

SHA512
f5ced019217627c516150dac68c1bd0aced70ae648352f1f897183744c4aa77ab23b89c23669240a6f2a79bd039ebebb3760869b50b4c34a8d23e29de79db22a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80cdf5b24f1d999a3408c2ab1cf8b0fa

SHA1
cc132515af7a2c3e7668229fcf7bd2e8863ddaf0

SHA256
48506a8638d60232ecbb005c3613cc7b17981ae61292b1fb75add73e81f48837

SHA512
2d2052b3a51ae254f77fd2a25c4a5271c0c63f188b1f7d6fdd44279d276f4fb10165b9de2cdc3363a6dcc3628c84f4fd456aa5b7536affb77a094e79006af218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7deaf9a7ac5019f66ad594befc3b027f

SHA1
cec28eef2128cc7537b7ae3133b5e39474989362

SHA256
b4b84e76af418f5fab79fe46c3eb4685991d6d32adf7db363e381424afde3e20

SHA512
d7724b15c8c4f8ab3b5fd3bcd5a4dcc76e48b3eb461c0c14a102e53b0bae4de3df850f62d94808fbabfb2c81020c0ba87e5c79dae8f5283f4ee369674b3b68a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3424554be4f821fb9122bcb0389fb61e

SHA1
58d3067e853818d373cde2345b63b8716ecf9bf3

SHA256
cedbb5ce52b6895644a012b99a22ab7f5f839722efe0e57d0a66608100e8cc5d

SHA512
2a9d0aecd9b1cace7bb1bff21ef78b78e72d37785becb27fdf40c1c315f1e8222bfac656d9f19ff4ebfed12831ee7918d8df09bb3e5772656dc4b6e8ff12eebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7961a0cb811ff163dadc6c8ea478fbfc

SHA1
ad06bd07005002b02cef5fafb47b71918bdbb1d5

SHA256
43cf88beca5a277bbd4783bcd8a8e167a53c35f1306be47cb4da1f801d299299

SHA512
f890f53278bb0bcac370a35b7f5b0b3e6c6cfe1a6ce5e915dca1d2fc4d824ee64ac7e058c4a29c29e5afa15d27e99b6c00776647fdffd2618ebfd27aa55933a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8cf78440b00166933a970634180296e2

SHA1
f8f6a23652b2c836934fe05104da872261c1a196

SHA256
ead8a3e7a4110846fab741b14a0e560eeb5b4ba6264d0fb2935c51140d10d6eb

SHA512
86dc5c0df633af9379197ba537ff0cc993bf5a8d1a290553de70b9642a2917d58098ce35a8fd41c1e1966fe1f8d79b607ac61034210254fb8849800dc02e1d52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7a1ac651ea38d38255c26e46147c678d

SHA1
26671d320109bdc7131ec0c40302c9ba7a81b20c

SHA256
a9f812e4e577f35fc17d4e86bcd1b0733442a86ef9853caf10ce0534f2d25ac6

SHA512
8a33a01cd04643a55252f81fdfdddef523646128de436a14023f09957997c9443d8b06ffcaf3a7ec3109b4cfbfe1ecd0be243ca91ed899ebcbaa53013123ffca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SO68H922\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAAE5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit