e9d94004e9c14fc7610fa800de139092c5e652fcee43e5344dac742c0652649e

Analysis

max time kernel
155s
max time network
188s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

014d2b8a6bdfa92df723cb2fd3ae5e3f.html
Size

69KB
MD5

014d2b8a6bdfa92df723cb2fd3ae5e3f
SHA1

d1efe0b616f32bb804fe2c97061a3d50622e90bf
SHA256

e9d94004e9c14fc7610fa800de139092c5e652fcee43e5344dac742c0652649e
SHA512

272cc74771b0217bc6713f4bcc6aa65e172e14406eb1f02dba38344c154e882ab9a11e5513a830b91acf3758840fe38599dc7a2ee79f6c161e13f5714e321243
SSDEEP

1536:gQZBCCOdX0IxCettYpJy6rrmzwlnFXSYx8axHFDiL7l4muB+Q29STn3t31tpzzDE:gk2t0IxRYpJy6rrmzwlnFXSYx8axHFD8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000005a4802182e1560f69edb6dd5896f2bae6b2e4d4eec26156d533e93ea39f3704a000000000e800000000200002000000099967997f06c410e4314d640649b65e713990a02711b274e026e104aaa145554200000000e87e5249cdc77cb32d1654f474d1b9f6428a452e7cfa9fdee1cc2acfffdd10c4000000023e541349c8a59e0418fbb5f72ecca503d7cf44eca7467dfe3ab387c55b4ed386219454b2e2e61b22e71b8465fcc59eddac4ff6971bf443c9e3c4be950dfc68d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3158B0F1-A319-11EE-B383-EED0D7A1BF98} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000f41fd8c4d0a20013e0776f80338161d893a5554f855c6cbde5ffcdd1e8212a53000000000e8000000002000020000000df4cf2686ed58c7a83291f7e3a4470d2897e72d54c850c2e72e2026d21bd536c90000000119302ad6375b9f47695fd9b41d9af990b6feaa5bc1ccee87092d635a755d9373382249e687a05d02f257f7d4d40f36b460f30cbec86b7ae4bde8176959d7839073441db14f233e5758001c51cc2e2e27a50ae3a1b412fa8c236fa75973e132931969bbc0988a41e4b46ab614e8cf2c6d6987d336ce3f92a0d240abb2c3cf7b7db65fd63c0368ef0645dac2ff52bc13140000000b07d1ebb83d6106e1b49336405b9d5903c0ab578947004f86153b9a538c91c3df8dab5673511f74d46126d1006cd1e1ddbe4bf10f694cfc11fd3da8ce7ae5999	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409665789"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 103e17202637da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2692	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2692	iexplore.exe
2692	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2772	2692	iexplore.exe	30
PID 2692 wrote to memory of 2772	2692	iexplore.exe	30
PID 2692 wrote to memory of 2772	2692	iexplore.exe	30
PID 2692 wrote to memory of 2772	2692	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\014d2b8a6bdfa92df723cb2fd3ae5e3f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
197b80bd94b8b911c908c45c534d65f9

SHA1
1bfc37a0b9ea22db632f430733118af2c8d25248

SHA256
517254527fd0107964b6cf5af0dce0e62100492346d813ba65c3d441e6f5f5fa

SHA512
6adf7032edc7c9009738d7abdbeb05a1193118ca746d8463c440903095b5fb53f68e9a038b572b2116bf662f50396be198a607b2909e3518d2924d61c25fbc49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac5805f10296ae6bd5464350e47ca6a6

SHA1
c03f3309f6380a99671026b5263e1524577415bd

SHA256
83cf4714e4cd0b14d3dd618c165a82605e6fc3b21c3760ff21a3b5402147e2ed

SHA512
00a2a2f464d8502d342f6a429fd8ae61dac3f0de2b60df2ab2d51ec20a4f759697030672147a96e0a1d78bcb397782e5b72aa0d8d133fcfb5e9f88f5d0ad8094

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bccb10112fdd260cbb871e175a72652

SHA1
293520d4e3c7df22ef69187fc88a0ab88d0870cb

SHA256
510737fffb45cfd5efc90fca1098b3f3e7a4c34365f3a6e659965f50f5280614

SHA512
b65069939681d9bec6f57f0128d55c36875b70f1c8f693c0e67a6bf4be820a6a6064318673e5911826b82deda4672d2f1c9662c1016c605cc6034eb208840b3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db7ce2e67150a9859e7d4ee79b5c64c5

SHA1
42c0d571125e6cd4e029ca41b94f60f36c7ca5b3

SHA256
f59a6c4c9b7985a5fdfa7f9e279554e98641ac609dedc05d01f605cbade45ac7

SHA512
0020a8e392b36747f64ffeaad0884fcb619921f02ab76d05fb633e6f440293b78cbb44aa4cc79f9d932a258ab066cc185ed185d2226e58966bb4dc35038351d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c26c3caa8dcb8190497bec0e54da09a

SHA1
579f2c839b2f0bb7d96d5bfdcd5f4eb77027c620

SHA256
da2f83d1765a2ac42928ed2bdbaede8703825f492711ce32e593feb23e3f0a5a

SHA512
23e59335667406c67935794e082367a47b94f813ba3f37d95512375cb06b86efbc967382e2d7e500207dac3563d5a9822db73b085c53cb1431bbdb58a594a3dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b65720e980885fa9780bc344c5b705c3

SHA1
21488956f43081d39ae88836573d5a93b12586a6

SHA256
e3f6fadf86844a6e829037e1d06bd91e7cea915bd9b76669358df5f4b20c8a12

SHA512
ca196e7b1b961ca98006805105a4d801f63fc8126e735778c29d936ab0abacc44f16141a4255d1eb3a128420690fbb4eb61d97733ecea868235198ccef58efd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dee7236cf314ea362e735badc5e1692f

SHA1
7bba39b97c0ddc7ae1796904f4ff4c58bd7b704f

SHA256
d838f10ae455cf2cd081391605968496fda87fb8f921ce3a8f10e6a753bd22bf

SHA512
0a6d027218dafeecffd3f857b2cb78e6d8b666e3f98ea1c5e69e55d6e31d08e46e7b6636590aeba26f70862f55257d815929b4843f3b69c13b86ec01024d9c75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f3dcfd0e4e6ce02062977cdc92f070b

SHA1
e29aaefe3808e229876b96d459de2e0072339ba1

SHA256
49cf4e107d5da6e463f3b695541cd4ad46f5e0f007b631e6ba9cc0ac4f7fa0e5

SHA512
c7b2ac8df9f54843be2cefbe15f1ec2db30dde7e8e360cc5e4f548d2358e661635ecd47befdd8f3fb49e31ebd84403b48e9d3383fe0e41e1997af0f7abc4d9f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbf1dbc6404ac9ab77c544ee5ad47d60

SHA1
18202dfe0b3b02e200e8850045ff320272a275fa

SHA256
41757c4334385e9997caf637eeafe0e3ad21a456e4b9d2ffefc41f0e1d4f1fe9

SHA512
f5594f3264bd3f9532c1b051b5d35bccc9d550866ec763ddb0739bb9eb353668ae466118c2b1530665501f4d0c574e450c41f7fc3d9ec8bb8649a190bd0024f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e9d6b52beab1440ab714ff573301b1f

SHA1
6269cf4a8a404906e622f3e751f3e37b395c7fb0

SHA256
a4a2955b7432f23140c125c681ace9b789624cb378881dc37aefcb80b1de9864

SHA512
82fdfbb5a5b56c7af41e8537fb72b52271daf426c01b2d665f1015e02c11c944e50b51b7e3b80afa48d6852bfd9bb14d9e2651fa417edf3f68acdb1e80596cc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a27547b4f52b08db19dd9ab2f2eb8f4f

SHA1
2b85a1c095d0f6d268cd1732010494a9d7339c11

SHA256
bae87e009ea91bf47c82489efd58271fc1e0d16ef0b0981e6267d779d9037ad1

SHA512
0ff17d9424442f93cbe96ddc571ee2dc149ffa273f9871fc4e37d848fb1711b8b23490b38b1a85abbba8cf670c6a265006a428eef6f5f34883ade60a39f73639

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
473b58e8088018d853984f2842facb44

SHA1
3731c2bb33010f6a8056299e2f80a214b6f3ab95

SHA256
bd6cd1a8dc343d25b0d28bb47754bfbb9a63a77b636dd1378c9ddb8736446633

SHA512
84ee5cd29535a6e4ed3513f5aab0d5fd3e03cd5d79e9ec0bb90f61cdb919cc85949cf08d249e7e7cf60da98cf8f2a995597d8ea5055d3d620e81b06e7de46260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd36b88946c65895aaf584b77da7a285

SHA1
491cbfb59e0e8be39e30644a63f98b6c2edd31d3

SHA256
37a3362a8159e8d998e9b1e6ee2d2592121fcce8bdad955edfa14edb6a032c50

SHA512
f7e0d28034a62ca7a51694e47a6ed9b65edde0650b77e4bb3f08c4fa6dfff793dbe5f3df04fb032ff7b69e8663d14246a56c006afcb6df6615ebf15156a4ad0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4175.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar41C6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit