f44679d50185e2e2758264afbda0e9586cd11d59d8120d1e4f143b9ed6622fcd

Analysis

max time kernel
141s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

058350c66cda864dffaa841d58644177.html
Size

132KB
MD5

058350c66cda864dffaa841d58644177
SHA1

318e2b7b190bfb3e072ff666eda1a5a7d9f2fb05
SHA256

f44679d50185e2e2758264afbda0e9586cd11d59d8120d1e4f143b9ed6622fcd
SHA512

acfa68c00033c571378dbce7a5fa1048a0a631e0b765355c7b1f30edbad9f8e2d454ec80bd88b1dc07d8cb80956134e2924195f3755fe14c6bc6b80c3de45fcb
SSDEEP

3072:73oiLwq8p5j918vxSwOA4WQI4HVTqBEMpo+DYGSQBCDg:7l8bYg4QI4HV+G6gGSQBCs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5015fbe93d37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000336d4e9b1c234dc16148892a02dd0af8d56a923d6719f93cf511245d8daf92d9000000000e8000000002000020000000d61ecf5e0f9ff01ddada656de19ae95db2f06265ffd66e1ea64b6f4824657988200000006981c3b0bc3624044a26c6cbe9887066d7fee0057a3a90339da8cf41b615e39c40000000cd91a5cc9774897a1012a1ca33722150eb8b6d958d60fe865776a25332e2575832c5f5baa9608928dabfa38658e704b137d1116f4f06df162e355b532a8ab510	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409676031"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0EDD28E1-A331-11EE-8FC2-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000894123f6cff75517deea9911700b4de391c350b0c4573fc7cc4f45b63d763406000000000e80000000020000200000009d922ddeabccdc073a3964eab0bbd989cfa3249765d6544274e645468272fc259000000066be09e36e9d005a433e70ccaf506570f1431d14c2c949f6753912dca4356f80e9c7f762bb18e6837dec92f82eb2d9a8d760ccd1c70556d9bf23323e58a7f46a65fc62e82e1e19319bedb67da94edb0028e2bfff1c18ed8e2fa2b69061ad59d19585387ce5ca3bd37652ee26bccb8a743b1d1752b6b49f1bc38a4641d13ad8d60fba80fcb0080ad348658857f06f1fc540000000a7e754b1c5f625da7f57b7751f602df06136a1b66282d47fec4fcf093b843f5df87c00158ca6ba368aeb64f407491bdd59a597ea94eb7e680b6734428b7ac08d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2904	iexplore.exe
2904	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 3028	2904	iexplore.exe	15
PID 2904 wrote to memory of 3028	2904	iexplore.exe	15
PID 2904 wrote to memory of 3028	2904	iexplore.exe	15
PID 2904 wrote to memory of 3028	2904	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\058350c66cda864dffaa841d58644177.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
7867b30a7470b33821bbfbd743c402f3

SHA1
bd0421047a206979a3555a5372dbbe575d83a88c

SHA256
3559690182388cb365b652ffb79eb59204a3a1f912f14b9a47f65e1ab77a4a1f

SHA512
4c814399e56aca4a6e3f6d44efd8954df511a73ec15f8f698ec0fa2b2bcf77f9c13f05d2292ea7a4cdd27c9e1d3603d348188c4123a920207007b2ac5da31399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1593614c49d8a21356a47daee720a289

SHA1
db05a88ec8a57f8f6513a6f1ee5f4b874d8ae53d

SHA256
b5fc046bb234af2a12b2e1eafa175d605a35567b47b1bc849321a3773091fe3e

SHA512
7906db68b7deb9dbd89e0051dfc4cabb1a0f8f4ecf07c59d388ce0d4f58d17be44a7fd3b292d98e6cb8e7238c80423cab9a4308438fe299b564a9ae338b0f4bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42675bcace96f2030cf2a4ab9dc3eabf

SHA1
46f2a897d7c2302035974849111c2c279f931f9d

SHA256
919e4e9a691b203b4ab252d4dcd77b6d8b42d1ea4415180ae964338d57495e2f

SHA512
902998ca360b236d0d8a4c7be38dad928b20f98e3f549ba0b6f124af2afac4687279459a9bff37a38db01675143b6faecaaca562a73be89c9b844f44c1b7a106

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22008e674f1c85a3960f6a1ccf3fea14

SHA1
ca7c823ab88d8b3ff33b9ff01257deeb08b4d780

SHA256
4ebab25d1e6f0757c42f81f4c7d565905f5ac3d0d3e6adb078848a34b3d6fe86

SHA512
8a72e2b05d7c575d2a4ddc116dcfc9964013eccac8ce169e41a6e54dda989d6d9ded20d521c1fc10fd6691a0ccffb38316d6b3dce533e4565799ab8c2e3a139b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24ff1754410d20c5f6ab4b341eb639f1

SHA1
2b622e4d20ca3f6d9c2b0f5688d499cf9c04949a

SHA256
58653a607c3c540771e64ff014254ee3332c23a4be2abdf6f7a55df485526c25

SHA512
615da706ef1a6086994c63fd86035aa35b63d39e1d805876a88fd5b2e9bf9cfe631b0a2e00fdb580df741126bdbfda9ebfa58520db96c362fea63553da3cd411

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2cb689dac80c3040b4de4b40667367a

SHA1
d7c1f1931dc8afc9ef3c130f08889d21dc4559be

SHA256
e8a88ca3ac6da566b47ed8b2b4a9ab2541b9ca10d641c013dd589c7cc3ff6d1c

SHA512
bffa02e26d5d80b58ab26ddf6f6a0f8253dfb56b9ee3148cce976f5c97ef9e26d300b95e29b8be51704451a6f7b759c30d94818663fca5d8bf7f5ef0cdb3824d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a0f7d689c74bebb3d4e2f8193d34db3

SHA1
401151b77b4a5ba0305f7ad36933dd9d04bed109

SHA256
046e9f1f4b3f1049f4ff0e3ac14faadbe470ddf98d846228c771c23935950cda

SHA512
e1cf02a880e4dcc9662c9a86cf81ed38f128195639b4341f8b15f4fe3a4665bfb7b1397c35ed37d3784fd1b7377f16c952b52f45937cde2c02e16392ef2da0bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8a8b5f3893087caf2f62019f1c73788

SHA1
ff099b5cf3f7f9c0c4144d1035fc8f68cd46215b

SHA256
1075f82b95644e5e6946e40e5c4ff87fdc03aed78178639ebdce735b019bbb71

SHA512
f673b5661c6cf34ae2f68603e5cf8135ce9c7128cf0cc95393b6754137b0c5e58f4e6b5a3bd2480eeb1d70cf97848ca969fe77a365f14fc4f57c0afe9fd21d01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94925739fc5c30002f720b49d2ebdbef

SHA1
4ff1fc33f4a9284a954dede7fca0028349f1e2d0

SHA256
7f078c765379466aaeaf57296bc5e39f83969712febed5a2c567b73ab8c59408

SHA512
214953bea0e04270f23d0736b1dda3511160777ad5b83b7e16803239c1e9f68f3b85d59efaddf61db719389847b58451f8c590c209330a8a29ad7e6e4a2bd36e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55bae3d311193eed2621f12afc77cc98

SHA1
c43e176ba5a743f89850758ac5ec511d7a9c66ba

SHA256
1e7fd2bbc61505bfbde6770fbad9e1a62e8bf9b22f821f4c1299fce1e167fd24

SHA512
d31a67d30bc77a0875db364e68fdc71a26889327828e3f854a74349e760fb11bbb196c3839b23e49e346e2f8e3a3f59b864857acc4d61931f4b53490fca03423

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2f393c7bb44a08a72f9fecd23d6c95e

SHA1
038f0e72bc96ef01f8050313931d83a3c90fdbef

SHA256
a8f134d7164203b5f00c7a6f81f602ab7cdcf7f98826adce30913ff78589cfea

SHA512
d60e119f6550fd895e5edc84613f97f52e9b82b89cda0b9a8ff6901cef28d296a8f777fe27d9ed631d1cf75190ad653980e07cc60f8af2d658e9daa3d4adf3bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3F2LH07\jquery.flexslider-min[1].htm

Filesize
5B

MD5
fda44910deb1a460be4ac5d56d61d837

SHA1
f6d0c643351580307b2eaa6a7560e76965496bc7

SHA256
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

SHA512
57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBA6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBB9.tmp

Filesize
92KB

MD5
71e4ce8b3a1b89f335a6936bbdafce4c

SHA1
6e0d450eb5f316a9924b3e58445b26bfb727001e

SHA256
a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5

SHA512
b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7

Download Submit