e0f19ff0b31298e6f4cfb13f79d74188ccd91add6f24e51da4494cfce6ea3055

Analysis

max time kernel
119s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04b47669db463b0dcdc5d7d7d74f20f9.html
Size

13KB
MD5

04b47669db463b0dcdc5d7d7d74f20f9
SHA1

516b2e6b62b239fd3bcdacd57511e79369bcbcd8
SHA256

e0f19ff0b31298e6f4cfb13f79d74188ccd91add6f24e51da4494cfce6ea3055
SHA512

39ede008bbcddceb9ada541b0afc4aeb5099cd2ea737a41b4461484ca54347303c407b6d50e82f48211db7a7b34220aa566cc02911bb4f2cfcc2c07033951497
SSDEEP

192:JuU5tMEs3ZW6S7ns7g72w6rg+zBv1B//zS8dX/6zUYimYrMK1v51haSvX6dLW:BDsMSLT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506d2e505038da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000668e05d8a65ae487e0d4a77c1b5747dad9423eebb71b4397edce03de24f68d58000000000e8000000002000020000000e0c1d9bda0132f66ba5af10c88849622c90b59baa017b60b8356320190fff84390000000b1510fdd8be2660e74e6f19765c1943040c2ad1adb924b3c38e71339e75a8506f475257be931fd4b61decdaf5b80de526aadb02f365228a1573de18a07b630fc0cbf733544c87d08c995ed123ec74caab3086e282f01774295dd586c76eb5580858e7429de23397993c9cc3f3dd32a7758ff65669d849d3622ad280a2f3c4464e71c8ad91977939d79734ea79965fa5640000000b1b233e827ffc132b71e9746a670421909a45cd82035acd898bfdc37ef71fc0c3aef20ee099fe8af67a4f61cb7ee075c49340b71dbcad622d92f43ed8e2f9a4a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409793897"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000003f97029fffda0520f52af18c1f38bab794f2a6d8fa0b08d05c1a6ffaac75a260000000000e80000000020000200000008288d4ef1debb0fd1c7c8add2e223ed2d5753873be0e35f6056ca52dd2ed90c320000000cb67581a6d239953a6805aa88dfde7a010e2d6108ee879575d9a9dd8a9a4d9d7400000005c25fb55cd35d1eb208bb7636500120cfab3f8de6ee5f365a0348d49b749739472ab5e57d4bef5acfe157b31c2a5d3ecd1559d50f6a5094124af3b73a56e9ba1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B5B7EF1-A443-11EE-AC0C-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2128	2096	iexplore.exe	28
PID 2096 wrote to memory of 2128	2096	iexplore.exe	28
PID 2096 wrote to memory of 2128	2096	iexplore.exe	28
PID 2096 wrote to memory of 2128	2096	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04b47669db463b0dcdc5d7d7d74f20f9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
002fcc5de55aee15967ee142a16ed83a

SHA1
c43861020e2034186d6150df45e2a411facac8fa

SHA256
3bb88b85237ba90461de7b2c48621cffd7a8c88877e1cb64e1361b8587af888b

SHA512
9dde216caa8932d3e8f822ec3fe77d27be33cef2c0e8f0c88fc5ad88c1a8ce37ffa7c6a41bd72292dfa5659d13b0e03a7d1296c47b3853c394a3cab3176e1fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2a1323e4e34479df266be5bca930a36

SHA1
17161a82012b519d4900b6a90dd64f6aabdf6803

SHA256
99b9ae6d5d4b00c2b305134e0c1be487624cbb4dc70cd10fc3bc834e60523e51

SHA512
54970a3b44b8f18fbadd2e432dfc73f1c3850d19424af97b628240111dc1606874ecd2bf1a022a54bda553dc47ed9c4622b4aaefb75021a86f44a8c8669fd643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee321189c36a125c31f526a0c58d0ab1

SHA1
dd8ffd407666afb38ed27585ef82b4eb96c4ac7a

SHA256
9b05d76a33d8a0f645ce8e92def70afd274efc9b04b3a45ef65e293ac0e0254e

SHA512
8a6b9b5a21d1d35e9f6de4f061c095654ca2a0411f83db269971d303a4ee10f34682aeb4b77778f7b2d810d8037444631223e43b5f8359a36bda5a0822b55dca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27717e218623db15120224cc67cc4402

SHA1
8f0f837fff694813243f6d30782f2faa0a8c3943

SHA256
969ed4ec5ce7a68f011395ff33fa6799c82be5f7ee1786b96a2197fbdfb8ae75

SHA512
9122c8da3878eb6cecbacea23572bf512f36ce668f47af8067b0b65cc4db26b817097ecbf904115d3049731faba36547166c6271e4ba2a8370560d5449a91cb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dab4cf0f9ccea699a8fcf1dc7bc5fdd2

SHA1
974cf7fc39f2cdbe4a9437cfa894a9be98e30154

SHA256
1e8f8a32c1aaa0eb24765275a554c0d30c56363a16706a53762843a990291267

SHA512
ebafa99c5adf4844a6397445e4b3f2e3972013220cdeac4d0339e118fd89a6d38d0bfc5502cddef1d7df6f1beb09e66bc192a28d8e63e0fc1e549696ce3e5b55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdd342751fa8b5326f29d818b4601471

SHA1
9927de9f156bd4e998fa9084548e5b2773eef06e

SHA256
e00eb721543b1ac7f9b8e6fbdf6f3c2958ed854415541e88224df79055987d7f

SHA512
e348cb6ba723287a11f0d0f974383c258b82a63af06e27a6039da64e7cb27f407611afa029073818d9201d228abf453c37f0e9cffcf94b28e0fb5cb5f70d5ad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab57b1f8ae4a6901f2eb31843709ce8d

SHA1
23af61adca1c55a20e5232643932b4b883433266

SHA256
23520ed2335996eb85b5bb74028206dc72a11ba43bb7776b1fbe9731a1a484cf

SHA512
df37ece9e6575b401ea06f5f48b654fcb301c10da988d9de3b58193271d84cda81366a7cefd13f2830b5040c221645c603b183a7031e05f62b353cebc047d18b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60c93ee3f4a78cf396a36e3dccab5554

SHA1
6ef508fa85cf3c430f6b700542636e1d508ae6b8

SHA256
f9af363398e802f838eb61d67cbdc3fe7a6e6aa2159e5c89e084ad01da6c15b5

SHA512
1c56f1a46553057fdcd2c7ed79909daeb80396d90279ba96d35ab697c8474d7c0586af1b41c366d92b31b68271a3d07601061f30706c88dadd6f2709a6629d6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc968a4f1d13f0b1a2fd224f21f0b223

SHA1
2d665914313a2ab38841f2b7facb87ab55b89367

SHA256
2c8417279377bd452dd6e82895e25eb66e34bc4edeb327416af45de69a32d0d8

SHA512
e10adf2e40834a7ac84df3c998c73d50896d3b92397835c75b43690b7db10d49310467a6d0c7524b513f91fb8ec94c717943ee4a0dbfa276b12dd499e3332d2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
361b63f0276ee26ffea37b394ba0df7f

SHA1
3687f8e418ac7da268cca37756b0c14bff8fbc2c

SHA256
e28572130dbe001248779b5ff64321d1fbbb0765bb185511950d33a807c57fbc

SHA512
22ddbae0091bf3b2aca26ff1975decb2c06c7f0292f2be134b1e4c73d94f0844f552fe240dc5a5072d17e1126a31899af0d0001018066f37096b2047583580cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6dc34dfe6f092c095e643d4e1f4f900

SHA1
892048675e2266e160acf4d835fcf99e00db8c7e

SHA256
e646da3c99faf80cda8acd56e364e3a0cde9f146c61821682c3f4a8237e6ecb9

SHA512
ed5ae3a53e5d8350ef0d59f78cabaa4f438c40909e957d88b1387ab41f02327adcb0379e4db3cf163acb41b87c46a93a0aa61cfefb1a07456a4cae1a01fb9b23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5abde54adb7d1213f608bed8da671f93

SHA1
076ebaf623f9906acf0e6626a9e3ac5867b678ca

SHA256
4691c97bec384b73b2137fefcad80045fa17f3405651b0fd0c67aa64526eeac7

SHA512
757d7e7a9129586cab142dfd8afd2f8df5f35df4b7ab4c516e8ec6c2ff34f184e905fb77864f86cf08a00d737327bf327421802557de1039903c715b3a59698d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
872e8a9fea8ea0d24f25c90461c3e752

SHA1
600c04efc736d84a938ff653c65cbb5f7dd73b72

SHA256
e8f637f66531e667a84fbc31ca37ca45d07d916ad2033215089edc61ca6e04a0

SHA512
b6124d6cd7a239b20c4aa393481e7d203d7d8eece77ba2e712a9fb74248c7f8e33cd753e22111d87f631be5887ed0132cba67f075d54d68a1e8beca46ffed572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f41be20da974e048ee313eec543032cd

SHA1
ecb61f74159fced424ab10eaa42ff0e5b2210133

SHA256
e82b1dd51f6f9a9575b89e9b043fd60deb2bbb033895fd26b080bcf7d665b8a6

SHA512
3ed2704cd991772f43f86c6715e1369feba176e182a291701bee71234d2c6d95d5e7f7280f1be758b87655d3c31921f123441067000aecb72574380a5a33dcc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6F98.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7085.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit