e050205ab5ec0c1a82b6c4ac4cc328cd724bc46dcb137d94dcf45ff03cc4a463

Analysis

max time kernel
120s
max time network
173s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

04635049b59905d1373acf9d57eeac66.html
Size

11KB
MD5

04635049b59905d1373acf9d57eeac66
SHA1

b024f0ec03a474cf73d96a5d6990d3cba5e89c98
SHA256

e050205ab5ec0c1a82b6c4ac4cc328cd724bc46dcb137d94dcf45ff03cc4a463
SHA512

f2e883c6b2ad81d5b8fe56c3f44d6187fff1a001f253305c131ce53d40bea6f178b4783d9446cc7b15b795dd3dc0bd521e96072f30ac2894cec3805517b8e978
SSDEEP

192:csz7gvAYS/GSXMMMnfLCuowPmIm3PHb76f:cPvAY8GSYIHS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000007c1d35b92c8d9633183e0e28fb14a3a0922cbad1515597b4947730fc28836118000000000e80000000020000200000008c467d5b68d59233b1ccbeb48adad5dedcdb6b53e6cb785997fb240bbd2ddcb6200000005ad30a2c31b2fa419598249d84713b6b33f83df137747baf4cfb62c9f779a516400000006c61e53ab8dc87090e9f9054a96c9d63cee6609fe4f702c888640d2238cb3a05b2fca8d0961be5a03ad7b7421d47350949867060ba383091f0fe3292bf361a76	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40fdbf953637da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409672891"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000005059b231fee5038e25b2c752b051cbcf44d7cb388a35c7bbe11c7e4b52145427000000000e80000000020000200000001cb8437dd2329c48067790b0bb1c51e927572dcf376e279a6eeaf0d7396a017a90000000bbf134fc994a60eba1de3222eda1b111cf55747c4e2c96796fdc80b546fd8f57a17673cb0e12670ecbe099147d3b2062c66f25fad6dc37e285bdbadaa6bf9d13887f38aea48f37850215dbe3ebbf11fef896f6481527d5732dc650707c7392c52555c650c64de1c320b856a0373d033b6d93bf60cabc74b1239dfa08788acbe4cb5bce2318e9bf72c7d340346056fa2a40000000c1fe58f61ed4d962aecb2e541032e86c4a04b8b24e475d22bb98ddb0f9b2cc7d533cbf61bdd30c5eb4a252767ca9f3448609bec6e8ecddb800c1ac474025ccab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE1FCDB1-A329-11EE-A892-DECE4B73D784} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3068	iexplore.exe
3068	iexplore.exe
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1260	3068	iexplore.exe	28
PID 3068 wrote to memory of 1260	3068	iexplore.exe	28
PID 3068 wrote to memory of 1260	3068	iexplore.exe	28
PID 3068 wrote to memory of 1260	3068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04635049b59905d1373acf9d57eeac66.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e079e0fc4ba6755091f73672670f8e13

SHA1
c1b17434c2377f5df1278c920b06d2d3a2e0563d

SHA256
9d858c1c541eaaa2b7b840ef9ac75c528c7f457585f64dd65800f57df22cb76a

SHA512
9699d97b9973eb0b212af28617634cbc40056c143fc28dbdb56f375f94d1bd4af8500f50466c2177ed4e9052eb52536557af2b48abc26384254d33241f1119e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fba8daf2a0353134fabe616ee5abd7e8

SHA1
1508db733ece6eb32d96f1eac676cf04c03a8eae

SHA256
04e6e41ba7108808cad732a0d10ac5124475611af1eb6f234886da499c5a6f77

SHA512
d9810491701a4f356faf8ec63a25c6c0bf462f18bf2a4837dd2a5ee921906f4dd3167adeb6bfb71f70b43b53e840131a9e4379e22047770d7aaf168f23fd0238

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5a212019419e4a0badb9346588ce308

SHA1
848dd05f94ea64a16dd07e13bbbb9aca94d6d859

SHA256
66304e9e23aab5cd96a28bcde4deb4e5b10ac15599ef890ea419280dd059998b

SHA512
fd11da456b2985ab83d3379d32ff1fd944002e79ebaccfeb9c17cfbe3b52a56578d0fb682df0ed4a6c1bac1bfe75737f7b7c7b9e5eb2099dd8ebb80f198d2197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c0c465611b515f50413516f61864ced

SHA1
6472f7a93b5e8cfc4660243ca8a6f3daaf2b7bf3

SHA256
cce060615667fe9eedcd6874c9ebd915e09fdd63c1525e854d9541c769c5e004

SHA512
cc335e6e3a67583691b5617350ce7852db59b854cea76cfb989fd6ec4a0d627756414d53874731a2ce1766b0d976b47082d780de0b4f94a6e3a765c5c756136c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee89199c612af8698fbc108058a9b700

SHA1
a0a72d2f4cd8624bb9119f94c701f99882a8a00b

SHA256
2b8d1a72e0661f2a81380b2d04d361950d00125feb9c6f57a1c72db3d23a8e62

SHA512
370655f41e367b8d91337eb48d50ed88620077eea316be7520598e1a7c8dd8543bacd06ef911519d119cde8139af409ad4d11fffa85a44ef82175ce00246dcdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
830fc5f314e3d9709597be5193f83ea7

SHA1
da3516cedc6fb7474f761de4bb11eb1f4222460c

SHA256
8138b697b269db6fc1f694369245a8226403ff6232d404835e15bc31016461fe

SHA512
ba65e10886b80383cc2d78fa17caad1f640176f55dd206d5a6d79b3b91b1f4f4fb1d230eca3d4f92e6954fdb0e4f20d16db6d9fb7c22c8aa792e8a6b3c7054ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7c56cdb93615760be9063e895318041

SHA1
b5921ccd7ea9752cd0940b07f4103d241a8d77e8

SHA256
71c9483fa1dd1b298f845ec38b1ab1ea04b0f3ad6de6583597819b24fa236fc6

SHA512
dde61cc9f94150cafce44d1abb7c1ce0eda30c2f0e88068bac2e283ccdee1fa930de0d5e415a5519ce4d8f6cfc3f1d95b29778706845bb7c4c4afb461d4fd1f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7770277889617f864b0a412585ed73f

SHA1
ec2c328ec8432e1bbf88aa8f9a8c2b208a9d6744

SHA256
25aa45a25cf3f5f236bbe68d4d8b107a160bdfb0a8283b37d93ee7513c35bf36

SHA512
4777c9a7bbbc305a7d5edb85eb5fa8ac05c4339db7ec5481a11117921438bb871d5c56eb2ba9e8ed01270f5981f298288297cab8971423e6058c40b51bf78e7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc93403cc7c8589ad83d6a7abdb5ef92

SHA1
ec32d46bdc0696841775a6f7e4d9a6416fd60a9d

SHA256
a88951fdef3acc490e00ecca58cfb77bc31c12f2b94d7faa722d25aec101b086

SHA512
be77dcc6903d2e2e73f5183a637dac51d3a91a2992992f170d9a9772743d3f10d72e3b36d43887d0508e3ab7dd4be2698e5b2942a2d6f444aafd08b93fac6dfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8552bf1e58c4cbcdbe560d0b7b4d92d

SHA1
f164af5ae8ed00a9fae79696aa6c893796c24f5e

SHA256
4450a28cceac442526cfad73b22cdc120684f526c25e89a624d86b7c029146c5

SHA512
2d991e0dcf462163f52c96907316e05c3860d65f32171ea43f9cf988d7f7a8e1532c0763d90806ade420bfe26d3d3dff5493a78b9758d670422a135f56e96524

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eefc332c3e5a4ce4e274534973a3c4e2

SHA1
937e1213310edc01fa6730af355aeebbcf9591cb

SHA256
d0d20827213d8f08a4d29f19e9764aec3fed7ccd529e93a2996bd9c87f3e58a9

SHA512
dcaa2d3296f607594e495fd5e24cdf2fc808dd6a1751418750a2e524ffced417f24a6a6067de1f718a708c6e4578443e35a90fa1783cee526cd152907c660b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE801.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEB3F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit