bc2c209184719a93d048c12fc9bec1bb14fb33e41304d11c9f41b2bff8598526

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1d799c5c0163fcba9b4ea27419058174.html
Size

28KB
MD5

1d799c5c0163fcba9b4ea27419058174
SHA1

57f5451befbc851c2c09cf5ffe5572f20dca4a9a
SHA256

bc2c209184719a93d048c12fc9bec1bb14fb33e41304d11c9f41b2bff8598526
SHA512

d5980c4f7b49fbf213c9e6cd11b2661a4705eac4b207eb32d2d8a80dec2881d8b8c464f266e4fc9f26dcca4d1434fb84c9ff330111abeb2b0bb2cd410d5f69f4
SSDEEP

384:h1lzlNskpmd1plTuIdGxByIDlujjH8N3AEjgAtDOQFOAzJCRBy8uN/4RFjXtXKr3:nNskpilnHs3HdDOMOAzJ8W4Rc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000abe7f6e11bae19f91440030cf0e9cd1d7c6a22905b1264eab7890fd1ad03264e000000000e800000000200002000000005547e209da6c9a9d470eccc7ca4dc894c094f545eadaf4e2ceb22b55fb9ac1c90000000e0a710165058036f380856077ba3f48a8ecdedb3da8e838a5fab5e0a818df9f85ccc1a956f6b08b1c9b850693e856923a7bfef0ed045de488f5140f48a3776be6f5002fb460d587065510e869259ec0940d85b88b17d8821dca85ad1b446083c6bcfebd0686591c513e1215cfc28b7ca1b3d21d1ba367c47019c18d604e751ee0f08cbfaf058758c8e1750d690570bb340000000bea8748819dec51ccf828991683b24e338b70bcc37c3eb0335048e4e49594b24dd6e6e7bd0e704102e271788c7df34381d0b8b481af1c4dd482422afb28875df	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000005e2dc5b721b0d3316eb3e4d59b9b3e4ec3cc1bce43469617380c2f9bdeb28d42000000000e80000000020000200000000cbf2a31ebee97087a4998cb93aa51f32f7ccea996f2b47b11fd47bc332f2f9020000000bbb4a256517368822de61b2069133d923bc163282c6daf216fd4886a63ec084140000000fac8f688497bce0c6b15f0bd69b3253a2673dad05fa4d65ff58e49c968e8be2320a01e03d667d7a266a8e9200c7cf25ab73ca1050e4e4fcd49275926252d0239	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3019486cdf37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88279091-A3D2-11EE-B2BF-5E688C03EF37} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409745386"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2200	2232	iexplore.exe	28
PID 2232 wrote to memory of 2200	2232	iexplore.exe	28
PID 2232 wrote to memory of 2200	2232	iexplore.exe	28
PID 2232 wrote to memory of 2200	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1d799c5c0163fcba9b4ea27419058174.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfee1536f7b7d8bea17f3d1e9a59cfb7

SHA1
e623c4dcdd9f79990215f4e9732b44a2e1b5dded

SHA256
c9106c3c56e2ad081052267772845b41e866ad7b6abaa12c7b9205ba9a8d85f1

SHA512
5a34b2c6bed68c2604a3af1a06fbbd53f24e6e301a609e1733cefc8f4d73e39fb0395770c443350558cf831133dd832a4bb5b24b6d2af6baf9668f2cc14bca81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2f53c1a55b1926cb02902249cbb1783

SHA1
89ca427031cf519edad93cef0fe45c81fb50829f

SHA256
1842ea06f542359578a2b9363ea51e5733219ed1b66a4574bf113cff114e6b8f

SHA512
aa8ebc29b594949e45d6fee143b88cad0b731d44ba82d8805e604dcac38569b4d3adf59088805526f6e13f2c4954f7cdf450f2c00dba0bda69c3e3e4d9c070b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebd7f0b44bb0ae07518fc22df32c3c2e

SHA1
89d2a728e53fb608ee972be2dd9f79b5c60af2bd

SHA256
26101fc889c94588b4c8b0fcd04baddae06ea96fecd8af3706be9bacfb613a98

SHA512
714bd8d2a2517f33a4842499923f8f175877f3c9a5087065352f596b0df4bfed21a17c7ad5ade965d4b25fe3aa8ace8dad9398de24933bd97c68d6332ac59154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
593e845f1efd75c9b154835d5a3770c8

SHA1
1a45fd938e30817a1764948e150d9bd30897645b

SHA256
f2a01cd593b6de73eb1a4ac46eb873e01f3f24e9e3e8f57c3dbe35b93d044909

SHA512
9872f50356a6edb36081159ad00bc247f504716aa452a5a3ae6faf86a6206c12290093510ebb74d76c75c23439d267109859f1e339f99d2725a8518e3b3619cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22c2265cc3a6bda17dcad0cc2706a0a2

SHA1
287f514a7917100cdeea676daf00893eab9fe42b

SHA256
7bc722fed8c02579be308cdec9e3888cb716f133143e9864595cb3a0a0f31241

SHA512
501acfc8bfbc324aae55ed79a030b5bf2de89c7e4140f37a060eab3ba181ca9ac297ce24d9f1a17514b697cd22c223b48af8a6f44adc0985f4a5f2e4de8d7a8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b43102b94b431533d5ed08517f7d4215

SHA1
79900144b1fe96957846e2546435d35a4dca6411

SHA256
0aadfba848d6449f6b45e694400f570595ec952a1082ae9d88f137f9efacfb20

SHA512
48760afa20ac4ebd6d8287ad8cca118bd7e5633fa8326db0ee7e473a8964229f6749b8a16e232d77cedf4138d661668bd971afd24ca7c0f0eece02fbc240989f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f904a9f10b3c3bc13f8a99bdd9fccddc

SHA1
e12ab4b1e735c4bd1a1b14712cba1d30ce4ddd5f

SHA256
0c9e523c55df7dd962bd94bd0218689e6e592685c23b97707e6c616116437495

SHA512
6abf92b2c43a01e982a3e05303bd58fa5f83e8b81c948ad78fc6a58d03c32eb3027040cb345cc0528573270148d258a5fc61f0f08936779ee7eab39bde9e0dba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd394cb633740de758ff9f1a8796a925

SHA1
21b0a1920284a6dcf650ddda09d4af4a4b56db18

SHA256
02a3c1dac5fe63cfd2a2f7ae75c6631dfff0ae9a1c58adb092b9910f4ce01c8d

SHA512
fffdb74ff2efc63ca3c68e6c37c0d1b5430587e3f3272aef217db94cca676b3c7a635d02304a32a137edbc6ef555944add028d1dd870e7dc29db567ac4cef528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67f61408128fbed391f7e1d36967b59b

SHA1
1c8b5ea1c8b32564423d50a886c96d68ea52e173

SHA256
682728eff38fc122896856969240abd319ca5097d06e93ae470bbced8cd58303

SHA512
610a4d0200099b931159f2227864b9ccb07fc926e1fb4983f798d61edfe0ef3068996ebde6c3370693e71c5f65e9679dde649477f4b342439cfec7066ff0c568

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a859473ec0b45a528c5511e8570f1b24

SHA1
ca82363088bbe309cc48d9bc19c79000f86f0ccd

SHA256
bc04f6c41dc184b056e9bb9494362a17930ea8ebea756d75c443fa18460fbbfe

SHA512
9341e336fafb5b9f1037d88e9f652c5356fdca44243f8a0b3397e836d3d2308345f36ab4cce68412bb30c36179d6209d39fc493e2b31604fd517319b7557fea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a2b286e1182980abec6fdf5a61de4ad

SHA1
e5638efa92fa778bd469046e41728435a3293d35

SHA256
b031f0f9ff7c4f0e9c800f2f04daecd47a67519003210dfb959e47a560aaa57d

SHA512
e5a3aadb619a04a43a861e884ec9d4e4f205fe9102fc996d44b2b9a9391fbc765e955f1383654f62946a304df4a2fdcb860d12cbe0ca55a4f8be9638e64dc477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a57e26701a5af37196c4f40d6c25e68f

SHA1
d95689d1d22988c1146fd0e2e1751370cfc279bd

SHA256
1be54c5fb8430ff4242a4a344905f4b19aab12d672070e08974a156dbf27e652

SHA512
e5ea976ee73d008005a67ab058107c7bead42fe452a7c3b512bf4b5ab061a7e3dbcd30361af9cd3b65121e08b227381a2bea2d1c6f813447256f58f78da47352

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
484479499fb92b12def3cb8022095209

SHA1
7569fecff179555b2ad102b425715c9494adf465

SHA256
9835b2515e130000f26131373cbe81d9007d7cb8f50c56644a6afc481d4f4595

SHA512
fe38d617f7bcf1fa0841fb7a261e4b115e86a3009615908cc508f2325c6ccc97e28cfdb46c17a2deafc9456706098d8cf3268444df128bc2a06061943b8b1355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E25VF8N4\f[1].txt

Filesize
34KB

MD5
d854bbb2246d993bd1f8687e79493f60

SHA1
28fbae93bc5e4e99a6c905fdda488be72057c307

SHA256
707248d75606cc53aad966797dc2cc86997d1ea1a74b1c99b9191716600c74e3

SHA512
ba4e7ef0a590c84310fb36ea64202cf821058eb7bd52ada1cc9fefff544b7500bf54a8ee43ce80b6cf8989071b0deaf2bf9a50c8063c192f24063f318585c3f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCB2D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCB2F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit