e975c9509aa3daff158115e125d17e0842574d2a15612a276b7a9d014dd89a9c

Analysis

max time kernel
122s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

084a947128acc4aac81521cd1962922f.html
Size

53KB
MD5

084a947128acc4aac81521cd1962922f
SHA1

c01d0f8675f738c06d7fad9c5320a11294335b8a
SHA256

e975c9509aa3daff158115e125d17e0842574d2a15612a276b7a9d014dd89a9c
SHA512

996f7d0602dfd03abcb451e3414fb8b8c83ef15fc6c92ec82c83c4b66332a836c6122a13626e238ed82d2856059920e119571c8d87637367de35e8196887b9ae
SSDEEP

1536:CkgUiIakTqGivi+PyUXrunlYr63Nj+q5VyvR0w2AzTICbbfoY/t9M/dNwIUTDmD5:CkgUiIakTqGivi+PyUXrunlYr63Nj+qD

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000008e3c744034b624bbf0da1085dcdbf8d5642cd2092db11493047bccf6de2c5078000000000e80000000020000200000000c22d1a916f632ab2ae2d58e2b38e5fecf3b232988e7b2d911005fb95b32471620000000bd42cf4d6cbc2efc71926e253cc871e25f2506f8ef46dd3f411573c8ee09bdcc400000002216bffd0e4deb6ef3f01688582fb41cd879a18ba2c4b6a9475fa4467168b679bc2edfcc0abac1d7b5866dfdd1a0edf50122ff102c90337b673d5a62960330b5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000bfca9eea8c18619e6547de52fd7e122f756a8d7b19f909b694b289b72ff29516000000000e8000000002000020000000e26d39592219559958cabdedf914d4f00c27f674a6f7e20b135858941d1f38e990000000a78972ec3f26f7641b449c2bc461db2eced2d5cfd568e1933d93c84bd699aa23cb72c01f759b2bcf371bbcf93e7b1a2796cad65ef850f9ad796d01f6f9c01dad9b179d40516b02bb4dd548eb3c1e2de8e93b7e8349f3b835ba7fcf406ce216234da4cfaa497e98106b5f7bda13160d821d76625cb87f5f43f03ae3f8437b3dd69e721f43bbe80c780954ac0ba3eecc4340000000258cf093906e0a38710482c50c8fd4de3a6f8726e8d41d8e150e08906766bc3caf49138bd72479fdb780e97148c819ddf2ed808d5d16c2af24135d0c04eca30d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB193511-A476-11EE-BF28-E6629DF8543F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d15ccb8338da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409815992"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2160	2236	iexplore.exe	28
PID 2236 wrote to memory of 2160	2236	iexplore.exe	28
PID 2236 wrote to memory of 2160	2236	iexplore.exe	28
PID 2236 wrote to memory of 2160	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\084a947128acc4aac81521cd1962922f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52729a0f8c684189bf62c95808d12fde

SHA1
b992d8659f03388ff232b97ad3171ab0aa3b4d65

SHA256
3bf0314aefaf5b93346ca549dbd963de1b6abb7763ad0340e802b4adf7bea128

SHA512
ee4b59579b45b023f14099aacbbf79468d22e528aa8db12c08be80b8e17278d24802aa184a141d083deda284c14f20c8b79ec85d7c81264528f86420ecfd715f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da8150061777bda9d82430e161227097

SHA1
099e67b153f97ea675962708540d970dbcae0a8d

SHA256
11784282877c71f24216054aa933f4b1386bd09e565b919c3eb088a566bcd635

SHA512
2e39dafa88b2d07837bf1c4ad17470a1a019a84ad014a0619ebfae25fde107e6bec6842be870d7b640d45dc5adff5f7178ed7d70fb693c35944f4c6043c29fc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2392307a4a603e5774a3995eb7996ec6

SHA1
f692382a30cc1a909665d818d4e13021045f8859

SHA256
2591180889b84479616a8ad15ffbf0acf5be410cc14919641259ad79d157ba4d

SHA512
85669b469a3fc4fc317896836255c8cfdb8adf12c7fd13a3e84591269f30dfb5f06faadfaaff44e94c6897abfbd6d18ed084d9e1812b1987f1e95bb7ea44be29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d12f4fbfa283d98ede86ecead50af273

SHA1
c33363435ef61d89779937cb824528205a773917

SHA256
3b98f155f75e259d3e639ce4d755087b80001d1284edc3d2fdffe798fe9ed56f

SHA512
4e1cb6b560ef7cba1bed2f15a7fd92a2667fdc755f02691fa9fa6d26e688c0a38f7fa0c2fa7d430de68e82221629b5631478b9a4465458f45df7030d54d4ab27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aae3b8fe3794f5943d72fdf4783d37ed

SHA1
6ac58e9b8606cc804d119d315f8ed4a892bd7f1a

SHA256
bb2825ae582919d36521493396a685b411d166a2f4a8a3285fc08b342ba4c245

SHA512
3a9b75ba273afb45df5e242a62220e0ac70d962e9b007632dfe72d8ee133332901c5ef5b5a21b2fa0bdf0382132da2a4cd03dd5ca210aac7cff7a31f8d890ce0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c04609453239c7ebfd1fa6aa16ee7c7

SHA1
63ab9b7d195081ef6876793d311fdb7d082d4e7e

SHA256
756f5a15fbc204730d16cfec9d997389c791c30fe508cbf1bdb9bd90504f423e

SHA512
05fb6bffba4ab3a3d24eacf44f96279d1e2fd158b981bcc92414a4749edae5a66f9ffa83ab6d6637cddd4863b484c07ca0b8be8fdd6afdf0580774860e1e5d72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bd2676d94d09a9ee99fd9409ba347c1

SHA1
78f7ed7962b799df4fd2eb72597c37b368bfd67e

SHA256
e70b8e45d43b17ba61b406be3151f7f53618ca2c146c9d546972ce25fee371b9

SHA512
f297c8d1c3de42efe3af53a8a2ccc991c571fede0d270c1fa98b7372ac3672eba9723c25a7870858533bb4f92a547ede2acb6ff957db229ede38cddf1d0789c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1438fe8c7326eee08344177a6305606b

SHA1
150698a1e91231520a4a11776bd9d495bdcc845f

SHA256
c6b0b492e196fb7736816d0b8b7d837317e0df289745f0958d96aad6d0678cc0

SHA512
919438afa1a43717bacde97c6d18d9e40dd941bce2a5721387dacbca8db6063a497cff763577c9fffbd9e4ea01c9e11dadce8b9d43500518222592896c6f4c99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae7c966de23e37546904924a3530e6e8

SHA1
1cb74fbb718543f4d118074b707e2b5f8703cc6d

SHA256
4a1409b72cca64447fec5e7cf7671deabc542d4b72cad207d8e3c4d5e7d77edc

SHA512
2f1531adbf45dbb86496d86923b954beb71bdd6e2ff3385b51014833dd10998f9077de3017e7769426aca9ef4b916b26e0eb3b0664cd2fd041a6369660345317

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa0953e46f1c5f066d5443852f367bf8

SHA1
1127d96c9d3d1f58a63089350b92028e78868b6e

SHA256
22e617807d7fa3b8f490a8c1bd02f08556e8b6b7bbcef3e36a53aa1cf03e1387

SHA512
910e30ba792657246a0b69e9a465a8c67538d8719e5a18e7605a285433e6112d1bf516e506cbb66ab8c423e578c9beef499637e5658d8000b97824d862f6b6d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3af57904cb7e424b1b1dc2e8fbbb2ed

SHA1
7af23324fd814539a2c4211caec305bf4079a73f

SHA256
cb50d20b9420df83b6107a01c64ef2a61c63fb6977375912bbca1813d3c3edee

SHA512
49c55ff13c7c242732617070e269cd2c4ff868d41a7dee93642ee1f0394060e18f69418167e8b45b9b7ad1e7789d9cf0da8e4a75b93ee01d9b971606b17a51b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a2b6993c79f625049f9ff0372320af9

SHA1
0b524763ef6cfbf5b7a1e728aa77086c58e1d9ec

SHA256
1705f7c442ac2af67429379fa4951cafba12c48e8a13a063cc4f1499dcf777d9

SHA512
dc30039f5107fc3083c09de03557204754fbe001ef4bc6d0cb625129e7ed6c9ea07e0bd3b2253006c8bce4c8a2ada76b2884f0cd9f8fe23c3d7fed1d289840b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0facdd9a685ea3c44a5f141af40ecfb

SHA1
cc2190cbf78920c46be9b8041e5ab36f5e3e07a0

SHA256
d22a7b8951a0bbc198530a29eabba40df0acb0b6d16a11d59d22128cf45166a0

SHA512
a2f45616bf77989437e7e8fab4b60f45539c32ba1dfa627791de6bc6eb951ba74a57811511444c2b4578c959d990af840a15d047fa74adf325e6cc4f10986526

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee96ee068381c7c04bd29b3ce74dd34d

SHA1
183485794e134d3074129107c63d82bab2d70bf4

SHA256
a5cdac4c13d25ab3b69a795d4fda33bb4e7dd6382d6fad1041a4499d38788505

SHA512
88a9a88bd43622808379a6429c766c46295b74c1dc22597d861b212ef379bacfb7340175779dd31515ac92d7d87393872ce4a2918f3b39db1476f704154bb696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\glossar-js[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA813.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA1B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit