e0bb7541b9e8b7f0bc309f0a9e12144530831d73e97315142dc45500641f779c

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

402514f9aa27a5d4b4ef5d7832f3063b.html
Size

53KB
MD5

402514f9aa27a5d4b4ef5d7832f3063b
SHA1

fff336369a7399a77c7e3fcd734eed81d752fbec
SHA256

e0bb7541b9e8b7f0bc309f0a9e12144530831d73e97315142dc45500641f779c
SHA512

7d02409eb1f2762f9a722996b7e0e36e92a08c8c775038e61d40ed9fbc649414c2dfc84679c5bc7802243e4674dd52f3d190bf81297aea9f51f80ad827920cd1
SSDEEP

1536:CkgUiIakTqGivi+PyUkrunlYj63Nj+q5VyvR0w2AzTICbbLo8/t9M/dNwIUTDmDF:CkgUiIakTqGivi+PyUkrunlYj63Nj+qr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a011774c743ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000e6732d69f7d293ab15b49fd89c7b6e70c3d37107f5be55d220b589d52738eb8b000000000e8000000002000020000000b858df00d52a5bcbea3f94ea5dc8e7444e3dd17767d4ee5aec61817542b3e5639000000009fb7589b53a4bb6af4470f4a9f8d6772d2f3e9bb978c0211760940ff40b73ad7dae23e543598f474d4c929192c74ef88cf316c1963fdf0e18989b71abc0f489292cc560f26d06334b8298cf9bb7db41d52c3c2d022decceba91151042cbe62880bfef533093224bd8e1acfc6c703ec1d3b2387b06e10f4cd70d8e142a1c0f1bbe7094c7d7533ac032ead2b009c81bbe40000000a22344ec492e8dfd3e159ba36cbc18261bfe80d4ddebb63e61ec3bf3673eba8fad67b65bd4e76467ecc5258a357225aed314e8e82abeddae8c0f54b79784f0e3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B95BBF1-A667-11EE-91A2-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410029206"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000aab5509a8e9094c7f95ecd703984906ea005c1b0e5698c24ec5901c454aec6e5000000000e8000000002000020000000e56a40c377a9e36c5616356846ff0e059ace589a048af018bd23888c09134919200000007601fc63f1e255d83720262eda5be0ddaaef57ccad7be24aecf7fc9685306e524000000063475c6a9195ea8d6e82cb38c5b91a705277dff7b6a4642819c4790d08426aec1ee0b95309212056d2d6631b03563f5f85aaaeb2bc30de651e63413d89d9369f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2564	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2564	iexplore.exe
2564	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2704	2564	iexplore.exe	15
PID 2564 wrote to memory of 2704	2564	iexplore.exe	15
PID 2564 wrote to memory of 2704	2564	iexplore.exe	15
PID 2564 wrote to memory of 2704	2564	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\402514f9aa27a5d4b4ef5d7832f3063b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2564 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81d085e6992050e74400f3e26214af0a

SHA1
905a3e8a36cf4a2ce6f6c3f83efad1cc4062a2f0

SHA256
041abcff9b6cebf762af838df0a3c15798077d2ee9a065d19d97e7ab7c3b6571

SHA512
c1680ec9715cde84326f613e033d8b4f8f72fcce1905b4ffd1a5de1bae6781f6c42a2324d74a695466839e3e2fa457a38f198623aeb4897c0da6ed94dc92c37c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
578a38c9f0349012f771bf7bd23d42a1

SHA1
abcc7d0ef24abba3822233c84815dd8f5d1cda4f

SHA256
e7ebe1ebccece4b764f63277571c86a3b83d672cecf3f71fac8188165d21679e

SHA512
1ff2e969e789c653bf265cf3619c71824dd20bfb9fb8712643f333d2ba299fb58557c7830a3463b191b46ac85aae0c05060ea5b3fda046674802902e6695fbcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef042089e3fc7bb6a805ed9700e14ea2

SHA1
c9a7d585c23842b8f708f35a9db9f56db3ee2d2f

SHA256
ba2703c8eb01861a45380b2885a5429eb1595beb0900747061d31fddc8943112

SHA512
85e9fc25782142db62a9fa40a935af9f3844f9c052bfb172b20536766bf7298f96751ba62d2fe6d5a9d4641d66f92721da4b3daff0f4880dde89a01e35dd71f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ae96051e79499a15cbfac98b4bc2cf6

SHA1
b4bfeec245c4414aad60c633431da112a531c327

SHA256
5f90e77db33469a639db37a36310d4f90e10cdfc9ca085b1befc316a4be1c32c

SHA512
ea2a166c6318350556707977455a841ad36206cba4641071848036a284a9169e2e661c8695c94511b14bf1249ff7997ee81ccb95bca735996ca7d3d240142f44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4c79101b37b124a9e9fbd090526ea8d

SHA1
1d6377a0d17e4798ad0c8d913cf826fea535b191

SHA256
e78a8151f7f90f65caa8503f76d2a41070dceb5bcbbfaeda379bf161a5cb758f

SHA512
36ade43c2d1ae295101ca220254c3d13d762edc9042e15a18c06bf0b426477ea0254b48028ae7208bf8fd7bbaf7822d711969ce0f69f06dda638d3aec64ba35c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e09a0d79a4ff6517c3e317c172c1a102

SHA1
a852a5fbd61793bc08cb60134453ebd90f8ce031

SHA256
f5a003764fb77ece98e881d58c305c020113bf1e7e7e80829f39d6d97e643390

SHA512
845ac4f9a2fbcfa0b2fd5abd357c8e960ec1748e4174f46b2b690c91492639c73aa3ebd6a89cec13e16d8066f84467442fd1405a92e02f9c66daf8f3ae27933f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fb00a2a8cee6a91c727d41cb5600af4

SHA1
5c28257d3b42fae5c7f3e6df4cfc8e702f1f9f34

SHA256
4cbf44d5b92cac90f287ea1fa50a9c3be926f6bfb5cc0d0b4d8d2b91edf3723a

SHA512
93fdb4e642c96975717ad1526810c8109465f41eda00f09278f381c2ad2ab395fd6e2f1ec6b017d3d09c59373d3ca9b92ddbc6e976ddcf75c96d59484141fb17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e0c754b855665a3aeaa628ad3d2e53e

SHA1
33afa70152ac4b1a4711720ba3813aee856d440a

SHA256
def44fd62932e212d3a1db393f5e4779842f8317dedf5915bd7592aa377198cb

SHA512
1020dc067989a01419adfd10b53f0cf484cd57d4e5194c4b749087c8a621607e9598a5e474467d76fc9475e8918ae72e892ebd6de2ff9f2daab9c0e453b22c27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dcf2163e9b5cfa25c031f060ef62d87

SHA1
20d743d5c6fd7b3908c249f00a33e3fd57dbf4d1

SHA256
934a9a257611d16f59a6fad0ada427911ce1a1f333431167435188f5a1081ac9

SHA512
1687a8c5e22bd5e9115e7b11f3158624fd3ab3a9f5f5e28eb978a07fe5f3ab4a8c208f8170eb503cb7719f610878e2042540157e7f51a2afd744f145c3d5b377

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80bd40056bd7a8e263f04f5961495d63

SHA1
30663065d372390bc546a2648bfe608572f8d6c3

SHA256
732b8abd8185930b17ddbcfdf83a92cd2a03bf3a01c4f52104b869e22e447b29

SHA512
71dc099442bdc1c1abc322c025b2d8e5f31572d10cbbb777452c18a8b2151fda0f3d189daffb2293774256512c33b0f8bcd8b1edb4aec84a4ce98e127bd5290e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfb0da03b54fd89496cde0368c6799a7

SHA1
407e80350f8ca43db6134a4a4d7b159c00f272b2

SHA256
bb478a27bf50600f3d52489e5e8ae16885c54fc9dac6ff30522a151af0eff383

SHA512
e540737c7a69d4f1db9f88954b6d3e50e1eb24d3fe96f6357bd2a79cb06fb79b9c0c6768d65246c4ffd9eb37f84c8af4d324e21e8b80ebdd48f6a42bea5ec0dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d11db8efffb762d8c146977d9a3a3c1

SHA1
3fd433ff7e924f106aa3228e918bf7953c8039b9

SHA256
e01b01018e6e95efbb8e94f463ef53b44799bb4c17934e82f853fb439d6414ff

SHA512
d342bdabd69bfd7d2ec7a614316a88c48770ee0771d02e75ad73e9adc501bb0f3863bf2cbf9c1370dbe5e6131eb5a2640f818da754132e4114acf9b65c51f122

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a03f4155f0549417332c5fff24eb8ea3

SHA1
3d133e9eccd463adb8a0f62b179c2b945947a059

SHA256
7e2f900feb6167715166712f0274343ec52e52a95917df13751232ac5a6a0585

SHA512
6263eea9878c22abc1e3429502b9cbf615158ccb29c714f5ecf9f15e546be1acd771570acbbeb6675fb7c2e93cbfdca0112498e153a81dc106632de125bfd7e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4012f5ce5c05a8ebe074302da15ba55

SHA1
2d15563b07096be3ec22b902a8af40c8a75d58a7

SHA256
e6e0fd90074fac4d779cdfeae867b6b42822d2345df61473c1bf8f0a2154d9eb

SHA512
3f0a045d346512041b70436a3ce18f7705cdb911ae89912d3ce4e18225be4e7c1c7899e90aefec7cc50e87b6da36dff459ab41b85741b06372f6f7aad86ddbbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
357e37183d0427712bc11155c3dc3137

SHA1
1691ebfb5eda7bd14ae1c477bd8ac27df24b582d

SHA256
11a9e3196a7a8719a63945f5ef14ccbadf690577362ee2cd37f82dc4208f79fd

SHA512
0d26bab483df58ad27f5788ee96e4db533a23f9600765e85606520878d3d34fe6ab68a34fd8b0e7df27b3945b17ce712f2e7e1b0087a2ab348201b5c9b0ff0d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\script[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab14CB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar150D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit