e64d6acc601f46bce5442d9a23dc378362c8a13dd14c02648411e7538682a9b0

Analysis

max time kernel
138s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04a475ad9a5bc4da0e552b03ba9bcedc.html
Size

21KB
MD5

04a475ad9a5bc4da0e552b03ba9bcedc
SHA1

7fc9e4764d2ddab62822774834526ad927c4b89a
SHA256

e64d6acc601f46bce5442d9a23dc378362c8a13dd14c02648411e7538682a9b0
SHA512

617e4f23e1d06c2986c5362417ce63dc8cdae3ee5a4f33d26efe24a8d1fcf9fbe39c01bc9a8633abfba076128ad55b4aa1fd0d541d5cc399145e798b4693f911
SSDEEP

384:4+QfPFd9QZBC7mOdMwO+KfpC5IgSnbmFe7AcI56vi8E1jYWPd:Zcd9QZBC7mOdMw4pC5I9nC4E6WPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C027AAF1-A442-11EE-9131-CA8D9A91D956} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409793580"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000009a878c892eaf385954203dc2a18799c0d8d03602f6217f966a0df047987b0bc1000000000e80000000020000200000005e9a586d58218e14d326a68585e6f23853b3e33912d50fd0a55611d35ee41e2890000000f12634bbbe7c0901f8696c2f3405106c45ad669110726c8b3a4b8b315d08f4abb57a6d40c4223e74be0de28fd2b8cccf6b6776defeab9c74b40c17b7ad3d64d2d67b976d1ba90d59e7ba0384bc7dcaaae2137ae66f4f9a0c27406f623f451b08c96144012f7f341ac6673c73e9ca1e5c12569de2a96f14d0fd34d64dd77b0945f390f9b49a0a4a781e8d3f4a68e0f0d740000000fc590b384e0a57183942453a3586d6912303cb8c3473134b7bfca60ddba6a7acbf672d3fb4b991f5015ba4202736bbe8a5a440941e802a426c1eb96e5dfcd40f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000476c6037fe7680f11d2a4e61d3a9365fc5ef7c106e69912258455d473e9e4bd7000000000e800000000200002000000026cb06a641451395b36362a114130856456ab38491ccea7dfa2ab107f829610420000000d7a919ba29b8a7742dedfc019141513dac8f882a78d4ee708281a3121b0e6a574000000025fe87e7867ffdc62959ea93c468d882b21922149161c245922274aad7832fe6a201f0ef2a447c207a807ff98c849ac8b10ca6058a4c836df1bbbf4f1ff63a07	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1056e2994f38da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2024	1972	iexplore.exe	28
PID 1972 wrote to memory of 2024	1972	iexplore.exe	28
PID 1972 wrote to memory of 2024	1972	iexplore.exe	28
PID 1972 wrote to memory of 2024	1972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04a475ad9a5bc4da0e552b03ba9bcedc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ce3c8704a615f169f96bc955fe75c4b

SHA1
44289cf6809e047c0c97a604ef100f0a8bac42ea

SHA256
f64bc63b45894d4678c77d05c6f70a2930281a87e44112ea9b56bda4294a0c07

SHA512
cbe710ab51013e416399b3bc7e7c22e8c9be2b440d51ba9560dac8cc1afdde869f6758ea5c44b6cd5ce8569759220008cf07532f32c4a8e26d66d782f3497789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29b9be395c5e770758cd6c56b61f187c

SHA1
ffb321e3b48df5fb2ee2a2e0f5660e8327a754c5

SHA256
9a93eff2a51ad6a47ed21af80feb5c07b3e1bf26ce933fff22384938e2558546

SHA512
fe85104105e5fd2f3616b798f5f62ff3bb85a41eed72d952ad9119fde4342ef85b905a097f8bca29f6e2a9994e8a97b632756cfd51454519029c4002f569e1f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97cc2eb25309741318e3eb2457704269

SHA1
aa0ffa65238045664538cd08b85f6e0795294b28

SHA256
275f228155c4ed46168fa2f0021d9dcffd59d46dd90f1eafe82f8a3b6be5f813

SHA512
c113f3fc486f5e0c11bb5bb68aff98223b393ee0c5f06b72401fcfdb64d30abf42bc0d207c454061bf3f9ef06ab30680677ef42a9ec96d4d7f423c3fa8e44d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eedc4d2cae807d03dad54e2a8c49116a

SHA1
0a9ea5f09fb7cab62550c0fd4f227b45f9d7d3d0

SHA256
2c78005f7d4a362f6c6f874f5ee8f02a44b068eb5839a6e6f73ec288ac911bb3

SHA512
a2975c9857050985f15fb38450194e78e6bfb59e91aad5d1c6335445864c50cfc4d448f616c64ed249f16c5f2ee9ba14227c6f0fd5ec274893499ec887949737

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23b581fca0b75ef4c9eb7113a9842afc

SHA1
3e1dba182697cc1f293e4ba114359184a5862683

SHA256
0a51b4dec2c2ec64d417c1d899e7faff02ede99ad7973354adf40b83f738ee83

SHA512
0c2f474a42e0c5addd162efb20c6dc7c682407a0f5f355074942e8a674a950b61e77714167abb174f7b1a4ac316d30500f178384b1a6376aca785a717f8648cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0e18747d09261ae9897254122b4b11f

SHA1
d7e2842f666f51740845ab2a852384850afd7ad1

SHA256
c6ac74d679ad9e7bb8ad32dbddc286a2a6c2164ec091b6eb830d2250e52f8fdd

SHA512
b1f3c66b6a433281f264424374f1fa7123c72bfe8d2394620f7cb828220fd5d67cd8398401bd3d781b2c0c4cc283183a5bde22bb6d579ea82f648b4b23b09ee0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f992a5ac54ce4285f5c7032315905247

SHA1
d4a3b4ca8f93083cf141e25aea57cbf231c8592c

SHA256
94fa53cb657e7b879221234c15f3e0376438687eb636ea7cfe083b8801a69d52

SHA512
2d9d9142db6182efb59f9c8449123dd13fa0b8d23a898203b3ef8547813b7c9aef1a6ad221283fbbb680ac7c466f39df107684071d21eabc75f7d8ffd54a2667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1a5cd5a32ca9ec5d34d4e2e3ecf0478

SHA1
508ae43adde2b9fae2ac6b51ca879faa13468bfa

SHA256
b8e83234e873b9faac2a74917402ba5330381df30c578509f5da8311a9573f23

SHA512
749b89554f382a0903a7bcf45eb27cb741f094a5c3acb718fc83ebc56d0117ae018126d677b2cb8b37013c81c3e80f32a459deb710996e9292f124cfe8e8c368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c627f1ca2b4ccbefacaba4f5ce4f2ae4

SHA1
96d0bd8ee4888fa2ac5f677d403b0e559c724484

SHA256
b8a8cd18e33628f5643bdc9769638e3e59a1f0619ef10fdb6c88ab8b921163c5

SHA512
00b04516d549adcd7104012f43a154a24db4c6204a1e405950b25dba9bfcb31699a4dd53f2438ae9b985f3e47a8d4e3576e6add56dd2468203549627424416d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84b11fb3dc2ef53864cc005cf9dab34d

SHA1
edca0f1a7562d4edad757711bd2ef1d3751e7b36

SHA256
738792759d9bf4821c5330e99d9451d2c51eb4a9bc8ff0b0edc2aafbe686c3da

SHA512
897c332333c12a21488f4ba771ed51bd4d7310b9ddb89b9de1f5c33e7d26edc5e0390248ce7cc3c6558ecee1f57df9ce67f1f8337ff664cdab7f50f6d9226ff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9feb554196a3de46524eb2cd5a60e6ec

SHA1
026a3dd02e7e092e5e8b4a807346ed897ea3a263

SHA256
8886fdce14dcfca39bcd639c261f0b37a6c36a246b9169e2119951a4d85fa3c0

SHA512
7658dd893a24a95c7e91f757c70c2703059e686b7c24e7405461355ec1fa2530a8d6e36080bff7ff981764e059bbf14556c67c812b3fa89e52dcfde6e1d92718

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23999643d9f1e6af7e91386f15c2665e

SHA1
46cdca362d87bdf13bdc84ca855fd80e7c30f3a7

SHA256
bc551f0654ab70d7a0369a2a77b1899054c659f4fb662d218d8243114049b113

SHA512
7ef4e67772ac8f697e04347104068e923efc5905878f853bc861258fbfffef0ef980c655462d1e18a46b91cb585271d923f17794d04d0c808145e7081a61a4f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1f457d105897006390b26e5e41364ca

SHA1
996cec09ef632598561011fddf54247ed4651d35

SHA256
1436fc3248aaad9feda2e796f7cbd159f926f51271c1c704cc8dd006823500b8

SHA512
4ab19f68a086d38c055bc8350d38d908165444ff0669998cc68212d90ba0b450f1fcbb430d0f1631e672ba5be050c07985abe136f4bd03a1f054e34de3adeae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dc1b3f5217c38be184da79ef401ed33

SHA1
9c57732a83fcb6b57e0dbd1194c947f63c5916ec

SHA256
ce54315745e818a29970f868e37aa84cc7f8218abd9b91c9c955d70e02ec3620

SHA512
7a4180f03632836453248364e915fa3386f3f994684ea176b2f6f47f6edf2ed49505ca6d6542e6e977de6e30648f636409a4ea690006063854111ee396fec550

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4E33.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4E45.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit