e398820171f6eb9cc41528303158ccef7a436fa02f3717800ceffcd440eb0fcf

Analysis

max time kernel
147s
max time network
157s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04ecee09dd024adc414bd6f336b30009.html
Size

25KB
MD5

04ecee09dd024adc414bd6f336b30009
SHA1

1a711e47a71ef0eb06aaeff26e7fa6ce7550ef6c
SHA256

e398820171f6eb9cc41528303158ccef7a436fa02f3717800ceffcd440eb0fcf
SHA512

65b1cee2fed0e6cf2c0b9a13d7814b149ae70854abb46031c27334329a02c8ef7bb07a6934426753e2e839b50341a909460d58e466125c753ac34a4691667acb
SSDEEP

192:3ZDqEuCo60OBnod1oQvV+p3PCTjfuKNiVZ2xJq8HOya1yUVV7lvbFSn5KcyxajJJ:pOpnNIwBwUwml/5/5N

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409795272"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B05C6031-A446-11EE-A552-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000046462169a6f702960e317eaa0f6e4122de656af063574d02dd938640e45ad5f3000000000e80000000020000200000003464efa32da8be2a083fa1502a2226cec277e2b4958a64d1fb74b5049830aa359000000044d6a31b3ff974b26baf7589ab55ebf8897d0dfb4c40b975e6b0a77e20301e340bddba5d23fc16ab46347d9ad4c00fb544cb31745c2150c1a41f2d4069e123f80d9b46d72b89f54a891bfaf069edce27a560cdf4a875aaad642807f31d82e0f59ffea916e5723cfd36dec0f906562b70b78aab7eec66ca05fa2b88ffd07507e864ee46ec74ad9d58f5498aa264d7c60f400000001cd79018d3d68ad8050fceb5cd8031d2428a1e1e32b7affcfaf458d79d7afc579529967c4f8f25307cb6fd0c34662aeb678b0b14d8b5b8cc42ddbdbcb5b17222	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000087b31bc60bad1857a7b98dd78c53a277df759ab0e4146284a62ee5f1dab79187000000000e8000000002000020000000f9ec95e6021b679f3ee3a9eeff7280dae21e184f8074479456b239e7e1ef729d20000000b76f01f18acc0746902059ee5f932b0ee58a9e9121603853ff888dae81690c234000000073cefa2c2bc4261c99a35d4776d807d05a1e87e60b0062542f854e2217d2994147a29c10d0a68873e82a588bb55433788f956dfbbf81f1415c8df873ac48d711	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09caf905338da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 3032	2004	iexplore.exe	28
PID 2004 wrote to memory of 3032	2004	iexplore.exe	28
PID 2004 wrote to memory of 3032	2004	iexplore.exe	28
PID 2004 wrote to memory of 3032	2004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04ecee09dd024adc414bd6f336b30009.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bb133dee98477b0cc5cc4fde772a53a

SHA1
783171ccf5710ea498fc6279f3add9dea62dc4e7

SHA256
0fee11ee1fbab569f25e2b67296456f4ebd8750d814c1850a901f08a9cb69f9a

SHA512
de151bda993d4c7287e4fb7ef2805993483dfea5d5640dc809fb72620d33e3dbed06e053bf64bdab4c5ceff1c61f2b4b2ab2f44ac59c7345bdf4a44ba49903c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c38fdf6e0c10e37245f7720b661ce3b1

SHA1
f6e4af24e82d011b1b0aaa63c3a2ea83208be5e8

SHA256
8281add123a5974ca0b4872aaaae1359e3b5f31a000bafb1674588a82680b583

SHA512
a75c1ddaed71937040189ad83e2181d3dd466e3d6103e36a8c42a3c414ae485afed0642c4353bca33e1b8b663c4cdb0000ccf9f14df77e56b3964d6f7688896e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
858a9233a1eaec4237f1799783f1dbe0

SHA1
8c6c3f4d1e7ec50c52edd3cf5e405d00a9bfea6c

SHA256
90f7365f66246146e4617f217677c425fb39521dcebb454ffcd70310143a1684

SHA512
81148b6cb91751fe0a71cc253c0b58de14e6160fc92c50525c1d28b94e58f4d32bc863938df74eece2d4eea8aa21edde9e9f5d77157bdfc5d9d5d5e14f639c7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ce543cfd7fd9eedf47b0f44a899ab2d

SHA1
1cd1b6aaeb727e32c83c3d4928f17583be9d311c

SHA256
0a3b6cd4acb6da1a450d00a57eff932635045ff869d0819060782e7cb71bbabd

SHA512
429d056b336420815e2ef8255da8ad7b77c47a4a3f93d5aab2190aa5e697a9314a7cd5f6d4b0d89d4d5906b140a8609720fa07e1f9887bc9e7d4d5046cf72b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
857d9c5bbf181f46d577efecdd203eaf

SHA1
c874dee20299a047a863dd2f73341f2dc45e3654

SHA256
de746abf659b5064699635f094efbcb2b98ef9ec38091290a8c0450979c5bd7b

SHA512
672a821cc84f1ca03996b65aaffe611a63cd7ee8e1ed0ad92fb051db3ad0cb6b29a9f1ca913251fb84fdfd646cf0b2c1e5baec049ab12ef85a7567ffa9256366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b8f69081818c8763e4af9815db77e0c

SHA1
55688e62a21631ccc1ea767a11c692a1a740f93b

SHA256
8563a06f11bffed17a9463684df4e9365987d7ab2f4232185784080e35a9aa3a

SHA512
f9acbc671aad6a0627e7010c1cd9a66fddb63440b4928e6fa8bc4dd822bf12e4394e37dd37177338488c34838e546f0dca85b21f6a2cd6c0cf07b5c8a8c95217

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a18c310be84451af7bf51128e37fffc4

SHA1
8f5760420c3238c9ee2f6e08c3d7dc60b877331f

SHA256
a3209e40b805d53a4a7810bdea25be77a9b96edc771584bc2ccb1421c8a85806

SHA512
d4ff65f4ce17398e51e642b05ae68e5de43f98f2789d9967ad2ac6ce3159203581c707de6368656f325b92c30037ee1b3b32f7dc9f93fe63efdceeaf9b0bd880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb65116e44cb98ea951cd36a49864f33

SHA1
a1d5617296d124e5c2b4bf5fd73e11d4302e50b1

SHA256
43329bbc92db0cf991810ed1bc31fbf8236371cca391f29fe5b16e35733c2c40

SHA512
a52e1e51ddd532c01fed166aa1d44f595d516c6295277da0e227ab3dca1a54a1f1341e571e45a17e845278263e7c782ba9ca921f2608dfcdbc8fe51c86a808f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16ab75a9a4f8c3158c97f7edbd6b68e3

SHA1
4d416d1834e628f8a898bf06b1a1bd6e8e112fa6

SHA256
d911336d783ec1e2a484eeacb82e4d3a99a8d89949841391a05b85257fbe3d84

SHA512
6639466c122e3e7982e010b864a4365e0ae7cfff6ac00bd21822dc275283e25ed81728304c65b50fe5a3d472c166c7e2b5916192768c4179dba7c0e45e8753db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea3041d73e52f101520894ceb41de97c

SHA1
e1558831618dc8a9512b8cc0404a7792224104ea

SHA256
70ecb6200094f35ca810613679f121ddb911c890c7a717c8f6cef81bfeee90a6

SHA512
37ba20e180f99ace642ba6faa94c0c5e4790d8ddbd770fb98c6f1a9d7aee84a70b3cb588f3086bebafd5f5346a2199fdfa8d7dbb9f4cb912a1702e0f1531f3ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c824f0a6eb1c8782d1adbca987a265bb

SHA1
b526b57af84876e044d6a03cc7b8ca53a07d9a12

SHA256
91be04adc50b23d3eb6feff9d29094edcf6f670de6870bc3bf4a520fd077c21a

SHA512
66e48d1826b206ab9eb006b4a7187bbf2836dd9cd2110d71baf33b7ee491d329b2effbcde30853d4f6635f55a91bfb8d0caf6758fec0fa56cb4debff47b30176

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4edd3be7ca3702e0cba9cb4078aea1cb

SHA1
cd862b26a384fff71ce68a7bf1b671df4bd66ca9

SHA256
017b26dd991606c03dcc2f3596f87d78d9a76ccc446015ef7de8283e2caa50b9

SHA512
248b1fcec4be93ec252ffc7f030a41e6c384ae33a4ada8b4c66281fa628dbdf508645d0d40ab75c67dfd0e7f6ef009ad924851c2e264e3d297ea40babf81273f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E5F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6EA0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit