e49e8a79744e6f2ec4db6878cc7ece8290753db85d0639552e5b11445eb3c842

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

409df29d2c2246d46b64d1d4c5dd0579.html
Size

9KB
MD5

409df29d2c2246d46b64d1d4c5dd0579
SHA1

73339f73195dc12d930fcac52e1597259669a21a
SHA256

e49e8a79744e6f2ec4db6878cc7ece8290753db85d0639552e5b11445eb3c842
SHA512

d3fe8b229c16a497a3987314e10382a5479c1b82fe17fdd0e37dc717b43cc834f3a65ba507569575b02dbad56a254ec4b62bb2d65224cc9ce1d2cbb07e332f98
SSDEEP

96:uzVs+ux7j0fLLY1k9o84d12ef7CSTUpGT/kPsipUlVHcEZ7ru7f:csz7j0fAYS/gdUPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410030520"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20f3a040773ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000d19713d631c108c3fec1f7329cbe45fda92fdaf1c9d91ab15d3755a75938e9a3000000000e80000000020000200000007e32cb435bbed36e12b04d3a6febb8f73558d2ad3f5ff08994b0e4a7d58b5b259000000058cccc0a9c9653bcd878b75db6cb84d3059f1f316dbd895545ac055f41c4a1a242a09b4d2c6ba88afcfbe6cccd8cc12cb07a0511196d229e88e57c40b0612ddee54814bd6e4e854b45af6811587069e205fbc014d7fc4d48c2cbd403b96994e3f0e4e87f8094edd6473ff45f10fac54724e6782444f9fa8163b59d8914f645ad53ed2fae37f4017dbf8943d15dd08e1440000000bae077598e84e20566294ce90b6cdfdffd4d93450009b6ca5e7706f7b18a049c119c7e4fba413562ff5795252f5ae933097a2f777ea58049dacd211c3e98a9e6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B5BE9D1-A66A-11EE-9610-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000dd3cc2e0e2b86bc322f2e821310be885a270469966e8d3ee6281cd7c161b5965000000000e8000000002000020000000f4e83a2b1c8bd44f846b3e1758e77cb3e30bc857f7dda8ee67ebeee352fbcdd0200000003a5b9e5399bfe99dd29efe02b4f892cb921c7c402ded8b8ea0db7ddf5156261d4000000019479d51021b2699872eb7caec335eecd05bf313ef4beb0651cd5bbfd3c1440389176acf258d18186a0b5e68336b684d71bc6d5a9c0dcdf504a46ea8cca8c192	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2468	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2468	iexplore.exe
2468	iexplore.exe
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2864	2468	iexplore.exe	15
PID 2468 wrote to memory of 2864	2468	iexplore.exe	15
PID 2468 wrote to memory of 2864	2468	iexplore.exe	15
PID 2468 wrote to memory of 2864	2468	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\409df29d2c2246d46b64d1d4c5dd0579.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc32818c56fbff792772901733b7c30d

SHA1
dacd0af98f83bf930332dffdaec58a564b438582

SHA256
d1d938c98d3dc4ae006414ad32b4c8dc2dc909857845f92ab32a29338100f4e5

SHA512
72c5296d10cfb95b39f63d2c4104217bb48994ac4ccab8858438693163caa648ce04816cd192017b8481c4b67ecbfbd2e050d016ad618fce78dab2533c68a1a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5b291211dc8e4219bd0ef27f00905c7

SHA1
fe9c14ede9740c8e2b822f4586c16a0f45b408f7

SHA256
42e112c1f6fa85a7f519e3486d1f47a9666cb1c49a2ee71c555195d9d5c24587

SHA512
47f0cb63b89573e131b6a39ecb0716fb5cc8f12ca879e3d3f1e15364fbfeb0200af7e15ce2b20b00f446773a8ada1e17675867ef4aba3176510dccc55414d5e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
233d0de9a63ad9014463f59b86b886d8

SHA1
0a9d698c932ac459a808917fae4dce9ba6498725

SHA256
9421136e72b271a2920ddb01456eb0b9c26eded74190fd0f296ee27507d7052b

SHA512
749021ed47e755957dc05c2e5a27d26bb1ec2db04b3ece66c79be893785f2b08393b6db52ac68e1a0e58b7c417309bb2870a58bbcab7480d5b888f1907bf40ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba18b1de6593f917b7f0a3da236dd252

SHA1
ad9a93d31ab6a199bb2a88ea4d4d033fdbccce6e

SHA256
372b25c46693b60a4715aaec3e69d1d50f61dcc7e122a2453eca5534c5cb637c

SHA512
4bc188b757ec423192a23d0c08552103bca064539b6b3c2bad4d11d7d8d4ffdb2b965515e42897150c52e6873810f9a48ac4208bde46b0bfe568a086197585fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
259290aeceb2c414cd8676b205a4bf4a

SHA1
4d137cff37e667cf94d17c45a577d178b4eb7804

SHA256
4eba0f50390709bfe1d1c9b88afdc5e7d2c155d76a345c5bf9e88fb0823d4e26

SHA512
e6968ce67f5c5fe99c73260460c46c6f51d05a51f074b9d22a5451524a72efb3e6d2ded0ee8911cd27c7fb07291745a591c837e69021bb1b1f5891224c9b8e3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3535eefcf962d71d50fecc732c59136

SHA1
07aa65a4690c277c4c759aa0bd841a0dd0d0c0f2

SHA256
c64e26ab04824606c889c012123cd7556bb934c9055488182dd43624f21e4bbc

SHA512
9965052bde4c1d17a64c5a2bf99c581f887dfdf3787e0058f233fa32203e3fc36e31848a003848e98d65ab45c29e279ebfa4afa04bfc1f9f4f9c46562d1fa218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4713cceb1a82536cea7d94c35c46c14

SHA1
7ffe9d2750ba88be59c0701cd0bb9c89c4ae11d4

SHA256
d8bc57132b5053ae62e40215f6e8f6ba30fd2820ab0364f51276f1a0db5ddeca

SHA512
559743a4c15580bf45e6e4d25ab8ed8f3211151224626fa82e6f672c1a5418c82635abd603e5263715833ac95a639e98251ac6cc7fd9a643d5459ca8336d6a0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0be16d29990fd703f86b8f5ceddd3f6

SHA1
eeffdd4a10594756a677b96095163cb2506e36b5

SHA256
e35597dff8a7b3f7b9ffdbfd019029c73563bb7d982f491827ba1c0b61e307b9

SHA512
da47af790dcb6d5248425e0cb32763a0b4a84bd4ec6c1d4f9481b1f04968399fcdcdd2c75a7bf7e1054dcf42762b1f9f69ddb242bbc6b46a79122183db0c1b76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d681e6d9ea95a322a86a885907bf2ab9

SHA1
3c41cb37a404196d9a9dea75b49beebfb6cbe9e6

SHA256
c6d210d01f02e8cfb2179d70c85d1cd0165e1c776561917c55f78bebaed009d1

SHA512
5c3b781a3abd9596d42fa00663612d68ce086e1bd833ef794bc1ec3071c50b23d3cb1e464e4b5ed030f5bf74c381600e2f31b6e9b206f7900466bf02be580f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
915d3e437ce01227adcea688e663512b

SHA1
eb9b9c117a7b24861158cba461b743bb9f97dfc7

SHA256
bb4b20cad96799f633d7781839aae0f2b4d99b933a28b237cd7adefb9eb3f7b5

SHA512
83ca56847972a2ea35b0b12b3946c61b719e2053d13a83d5d9cff00fefda5116f616eb69868f3096fe9720dfa14545ea102f42003e4774d7c144a539e904d10d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab50A3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar50B5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit