dce9ce09d8866240e97d62077eea15abcad13e1e55535944921230f746d267e7

Analysis

max time kernel
168s
max time network
175s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

041f7e92024a9961e30518c3f068bf12.html
Size

53KB
MD5

041f7e92024a9961e30518c3f068bf12
SHA1

c76c1b5cb0595621130da7c5648a3fca0f35d96d
SHA256

dce9ce09d8866240e97d62077eea15abcad13e1e55535944921230f746d267e7
SHA512

b96c4583d8ad1c32aaae4bdaf2de4cac3ad7caa021fea55013d15a70851e753f1ba54c8225d5c1e5ca43d99470b293ec4d0ee18e46f27c887e44a9dc62266815
SSDEEP

1536:CkgUiIakTqGivi+PyUyrunlYK63Nj+q5Vy0R0w2AzTICbbHof/t9M/dNwIUTDmDO:CkgUiIakTqGivi+PyUyrunlYK63Nj+qk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08578050-A43B-11EE-8CED-6A1079A24C90} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000064cc5b6407460a803c64bcbf2f5635f8ff37d0b02cc0c585147d7611d8f51f93000000000e80000000020000200000003f2783dff4a8f19fd33337c734aa6dfb668c8679f9740dae38fe80fbf081fd1c900000009d7e1c4b21c6701e02c95a335b00a8f0fa2a32d26d017a04db9c95179f61fefcb210432b93677a3d370b5b7c5106c7bc4e928a1fb6fe5cf1c9f12f71278b566f914fc600c4bf3aca3e6c077ff48484b891d8a4461ff930840090005186140f25028d6d19fc650015976c32d4071ad883159b9d2b974736c40a96ef96afe476cc9042c1ddd1fbcec9c5b644df119e428c400000009cee8078b6d11f491422fe9e337d93a0ceeb0a5672cb8f70a827ddd95bd6b7096d32d8aa179c88ecb53e52af51b32739445996d591e455fc9f16a9be4b4bf7de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409790271"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b43a0e4838da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000ef20b74a921590e53e9c965eb2fe4343adffacfcedf9e75ad063db5dc3505c3c000000000e80000000020000200000008172c5c2678b2457a60e2a8437d2fa0beb509cf1bf8706233be947ad55aa0b5520000000be678361c01ac0a2d902a1a5eb4ece865b6e37a8a078d47cc5c064dcaa11cbe94000000029a7cfb7e771933849c6919e264daa1678562daf142c539eba6b8d6ea7bff396476f4244abd41de86eead534f4d1df1d938cc514a790be38c40d9004810c2203	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2584	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2584	iexplore.exe
2584	iexplore.exe
616	IEXPLORE.EXE
616	IEXPLORE.EXE
616	IEXPLORE.EXE
616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 616	2584	iexplore.exe	30
PID 2584 wrote to memory of 616	2584	iexplore.exe	30
PID 2584 wrote to memory of 616	2584	iexplore.exe	30
PID 2584 wrote to memory of 616	2584	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\041f7e92024a9961e30518c3f068bf12.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2584 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36d61cdb469f65bca1a180b4a406c11e

SHA1
68f1398d40b4b297d637056e7c75743ad18d3381

SHA256
3343680ce6ce91ce31f5960c3db7dc4decb9c04e7f7f8c805926366db0a1701c

SHA512
c01635b375b0c19464ea37e32f98bb59f29d08d6c33e3564963dfc7f7edea122bf958c8095a6d654816b4802f374ff01b05def7911621cb20c9521b5db339f9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01abcef04d79ec326ce6bec74a417aae

SHA1
a429dc0189092b82c27bcee6119bd10e1e39b4a6

SHA256
32d9978377a1ca3c005c073d2af802be5c90729ca2a7a90da93b84cf21922e48

SHA512
eb86f47b8fb3c7942bd13a42d4dc3e619cd74fcf8c0bd74704908cdf47f3a988d5cc31be08be89e2be48127a77e2b5264f90ba58ba1f347b5823626835208cf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf23369bd16e12ea2d25d40524bffa3d

SHA1
069b442aaf2ad7b0f132c4addb3344b48f83da27

SHA256
321d52767db28f79b9ba95834d25f878309215521ac3dfaa335f7a2d65a77293

SHA512
df437c58cca906c5fcf217a20b0ac12f81034d6275dbda0cf6ce7a82fd240782ef5ce6003f1aa2adaa9462ff599a69a3f38f4f1aeeb2897659d8501252cc6a68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0b82871147cc9988256241d5001149c

SHA1
f0e2ec21f844fdff8b5a365f0af61542a20a3dd6

SHA256
452d46c1c6fcf3b1f1bc6e557f44ea8bfe3faf28ed13ca4ecec1d7a04fae7033

SHA512
d1c5dd4d9a1d558bd30de9bacd76b743ec9e8661ce8d85dfc9f08dbfc18dbe97094588aaa51aa1c4bb2f41a1210e251503282ef70114822dfcb136841b5c985d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bf5978b804693d9fe0ce85d30c2e03a

SHA1
22b0ade2180f19b27fb3b108eb443f9b763aa4b1

SHA256
b610eabb0c8e0d997f14c8210941a685110deb0f1a6d0579414ac93847bb315a

SHA512
5cea8c9b188213cff6cfdf552c460d1a570cbafb095fda61718b43a3ff9151fc96f656be7be38e9a7b41f2a375cb6142801ecb1c5e8c7b2d6bd7e31a4a605f82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79bf83b6038ca3b4fb5c78b68ff67bd0

SHA1
12e17321b1719c51fafffbb2e2c194508b0f3b2f

SHA256
3107f6c7cbe9a0f0df1c3c5080d55029261b29b423647252242a1b40c284cd42

SHA512
df8436fbdd619082184804c4c18da4df9fcd5280e509eff5d46a2640f1db1fce625e59e38ec6e52d1a37919d56699fd2914abe7e96df2f9777cb8e1fc03e1bde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2104c2c902dff4826406e8a80000a55

SHA1
e9acb5292f160638ef78bf03bb1b62862ce9da6b

SHA256
1ee612bd1f497d60c1ac15e358d4295d80252dd9c1664c752c2c5dee90c890c4

SHA512
53fa9750c01ad2932ef88719bba15cf18df40d9e412f808410a978572fc09cb968ac8c5aec921d74d11baee51310e892600fd728f49f781f2ba7af2877a8e57b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fadb401046a0913b80955e8793e6984

SHA1
3130195326c546ac9b14e3060632e11dd0bfa1a8

SHA256
6faecc64053242595efe37feff5105bdbcbec5a1b3eda2b0753eb638d4eb38d1

SHA512
46548a4d5b51273f221988dc2d62b5ff543a87be3d9f50ad47429ac1a7d743c68391cb8f6f0264a25b0768fc4e69557fb880a9105f71b35a9aebfce0125fdaee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e011e9528d28ef97a524927ac1e5fcb

SHA1
6e0ae91e3c8252382ac36c4ee29bb30bf46d4324

SHA256
f3b9fcb84b4fdda99c5fffe15949267a28d5269e63c5cffb7d24e3c3a70b1347

SHA512
0a97d322b0b807eda3f6e4053f55c7d8c96714e28cb56f046d02da9f294fc5e4268250a4d49749aad818f067083db48b9607b51510306d63b45737779d68901b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c94cf8553e03366377c17a7322c5fde

SHA1
5b38bc1a48563028b5f99fa8aa8ef4794501a34f

SHA256
99ae463fd9c9f6206abd3bfe6318c7e9727855818e64d8bbcdb9160e7531b7d0

SHA512
da1134bbd33b3ce9f7f2ecc06217651e370c33949393abc1f45a15e2c4daee05ab3cd642c23d088d2b8dcee3e2cac76a309f21efe72c58e4a36dc7bbde3574eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ade2d9225f3b98a7bffc8cf09056ec97

SHA1
18a05ca4dcdcf11da46e335fb6c1ae4651d459ac

SHA256
7bf5b1d124e8d16036c4c76d440c1431725c9bf98c6e7d745228c7dcfe48814f

SHA512
616bb0f2318fcd4489bcf34fce72ebbff1812156d8669ce600032ae61f903cdab7972817e8c83a694ceadec2681b9ce17f9e934f19d92ebb78a93953bd21467b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1023de72d345d56bb5dc82ec69ef1cea

SHA1
b3b51564708c94b75884aefdc51f4f6f049a9876

SHA256
890677e1883e17ed1b801f32e3638785bf00dad12ce0a4cbd55215302e658b48

SHA512
90b07f972016b902bb1d12358002e005f6a6539e3584f53d0cc4c4ce0cec778ceef55f7ac467a4ec11e6a22e5aa2dd4922488228780453d32004b1a5341cbce8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b2fb90969408ba89d10298499b6db71

SHA1
f1ec7124682c1c11059d9aa1d337b0949a413ee6

SHA256
9cd815a9cd56bbb621eef9cffd4490d8935467a3747900732a9de62badb4535d

SHA512
aae9d0b450d81bb10f486373364e92a5d6d7de9fa2d7771618e9dad2771cf740a5c029a711adee01f566f72c81eae15eeb90d4edda4cf4884355226da7b00f5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CTTGCPI6\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA24A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA308.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit