e43e156a054204485b7a83370426776cdf54b3b738d2a976acb37d769af8ffb4

Analysis

max time kernel
141s
max time network
159s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e8a94efea00b9d052fd0b7bb82acd57.html
Size

44KB
MD5

1e8a94efea00b9d052fd0b7bb82acd57
SHA1

1980a368b5224ed5f8955036ee51313cfe46e003
SHA256

e43e156a054204485b7a83370426776cdf54b3b738d2a976acb37d769af8ffb4
SHA512

a2d43c91e6a39af4fe64e58ab4355a7d62eda4f1963b18a16c3d8f366cb28e4a6d51ad783a11dc1fe5c9e3e5b7e513893e8c57529829f74e41983668d76b9166
SSDEEP

768:Zcd9QZBC7mOdMIbpC5I9nC4grtXjE6QPd:gQZBCCOdn0IxCFrt/QPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{39E2BA11-A308-11EE-9075-EED0D7A1BF98} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30bf05151537da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000065dd5d3f417e9f2abfcdf0186dbdf371b86e6cff08d8fc2d291868976b28607e000000000e8000000002000020000000ddfab8c8d99b52313952aafd9d226c9263bd4fed218fc466a18c529ff6d39b1a90000000e45f60cf3af23e9e15c4ea1179d64bca021f49aa5accaaeabc3de6fea5afaffb110fbf2c9eeb599307ddea43cd83ffacbc51e01cc7c49366d33202d5f315e719691c704fcde2bdbee9dee70a9642bd4563bb8e063c5cdf620c727e59934e4b03a3b153e4634515119ae0e1190e8e3c7815345c05fa32bbc7e9b050025259c585e736fcda29b7d1533609735476b38f284000000072de63378fc8bb5110bdd84bc8e681fa69ab08cca1574d3d16e4d1c9e637627c3cb961fc5a62e3e5d9a2a42754ae5b02fd6d40d0376a06181ad0a19cb69445ed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000d33bd0f6f75d7692edc16451ab270eaf454750559e58e9d6e6876126a6ac48bc000000000e8000000002000020000000f1ad84258cda62d3d441a43ebef8c91d7b97cb3077b8a22e58e37448165c01ae20000000a184d3d046d27cf9e77cd950495a7b2fcd71ee4ab5e86ec9b9652d143a9cc7d840000000934e8e56e29dd6f55a0ee7ff0b2cc00199256476632be80eb490dc261d567248b3c6376d9d3b424ec08f2b567ca020629a6ede41630784b1bd7d4965493a7493	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409658495"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2656	2228	iexplore.exe	28
PID 2228 wrote to memory of 2656	2228	iexplore.exe	28
PID 2228 wrote to memory of 2656	2228	iexplore.exe	28
PID 2228 wrote to memory of 2656	2228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1e8a94efea00b9d052fd0b7bb82acd57.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e49d7af410a432f02635101cd42e0a07

SHA1
48d84076dc1d12c35026c11d69b4aa7eb433f548

SHA256
09314df12975e4a83f0a7b49f0b4263c329e23f42d034040f0c66b6dd4fc86bc

SHA512
d77158b139caa0e1dfe8bb9ec292629c77edc791fc32f98f714a14a5af11870ae54c5e659318a0ae0ab90b8f5bf7daea48c194fbcea286117f758726b16d61d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0fcf25a84dbcc3807f81d2a0726c268

SHA1
08cb5d5d0a3077638b8a419b7df1fe481962e74a

SHA256
3553fba52eb00a4d452aedacf387030f15c24e8438f589793e6af6982bfea9eb

SHA512
adc55a765fc0f2cd9e8cdf292b3854258215b891dd758c107ce6483cbabcb82c327d86d9779fc580492de9e555dd754c9d4f6aa03d5f0e73e2a8fc142c0d1ad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77c164bc61cb8b2bad7cf77c4366c4b6

SHA1
97c0f4e7fbf2e16a4da1a983ee178d82de144527

SHA256
73dd788309cef088f1cd8060550f04612835b735815134e4d4d1516e9ca183ee

SHA512
d178e49a172493e3818b3b52d333098a2cf21b45499657c176aca136dd2e3c932791e628bda30378ab1b674d2816bc97b8a739cfb6f7c7c1e4a2eb51bfd02e8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1359ceb6c575050c796d18b51b89f406

SHA1
70ad6131ff3aeee4ebd5f7ca05714bb58a87df16

SHA256
bb70c6b74a04cea3d8d828da543858d6888417f5f3f07a38f3299c33cfc697d2

SHA512
348430292669f3b87a1e2810b88b2ad509ce5f815cbb6b27a987636c4932ba88b10fbea1840d361116c996beb9d800daffe188c14361bfcdae40c7d57cdd750d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebb67e8639ae626b30d15925ad98a3e8

SHA1
e8b58efd1060cf6d8c4b9072e739732416049dd7

SHA256
211a7b6725a5200cb34e772568e23c765390ab498281d077c7ce8cca212153fe

SHA512
0d716153dcf32d8ade1e3829e659de241e5e78fa4fbe21b3244cc44fc8247b5b3be29e56b2be5992182da324cd19960abb140ad4e05ec55eb75a68b3eefb84f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
571e3d8b01aea3a256511c95641398a5

SHA1
ae693400987b3c53f3b093cca679785a6184f4d3

SHA256
43264b9c6cf6ec8cec47d9ab2273454b8e02b23e53595701f4ff91cbd8e72bde

SHA512
83e32a1c8eaa907743703ead6fda7c039c1464a0255614850f4b9f3c1a90cc828409f4800b0ddbb74a92df38770ae7761ba078e39c531c895868ad867f62972f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73272fc3e58445e87de702c70224af05

SHA1
948255761a9f6565dc37f23716a4de9d7a7c09ea

SHA256
092e9239ae1a0d221d8e320fe195efcc874df805e383ac495c0c032f7445088b

SHA512
ef7aa288148dfb08b3f2f4d918ee92db3de3e273f008410c8437fe65f489175de0b5af8b924c22886ba9051edbd382df0381a10b73b1520ed19b5438bfd09396

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53270b368cc3e2f766897d26d633abff

SHA1
df62caad8a602f037cb2decb6bae77e35e0723f6

SHA256
d9ecff4904b11149f651b7b416c44a5601b3145c1824f875a378584cf469d312

SHA512
6f4bf5a938baf57c3eb3a4c2b7d5a5bbf06f9022f5839a4aee71be1d6a89802c6cb6974e86582403e13756af21fa39c9b16505057486bf939499d4456c7d0b16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76b992838475cbad4f2d8e2e7d593947

SHA1
939a2113194060f41e1c4d3bf2090152ea38c2f4

SHA256
ed7968da148855aa827a512403e61db98dab1d72fbd37f6bce74fd0d25915a6f

SHA512
af8997d63e573e1078026bea6e6f1fd498c67e6eda53b13aca514d59a54d00fefbed7bdd53fd0f99bf881e2e04907b0324fea750b2bbaaef3b03f57b847ace86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15c52180341e5b4287b83cff275fc8fc

SHA1
dff5223dececc5f6f91b1e1de7525abc22d5bc4b

SHA256
7893f6c23601d8121cc3505cf03ddfa39310f704cf37b9895766a778f87ec095

SHA512
6bd9fbbb05bd9624f7949226ad2f5ec6ae64016f5a670d2ad1918f86fe80fc4b15db2dd0d2b5942ee98b04e9a6c83793e62b6b0bafaf643ac625c73459eab241

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA48B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB15B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit