e85834c1a87bd3694811abf9b4d4445c347af40f8960bc75ae1b5f888200eef4

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

05ec602e2e082749606c32f42f4c42e5.html
Size

68KB
MD5

05ec602e2e082749606c32f42f4c42e5
SHA1

dc1606d2b4370ac1b2418714e27e11568e0fc117
SHA256

e85834c1a87bd3694811abf9b4d4445c347af40f8960bc75ae1b5f888200eef4
SHA512

af848dd02d01e137fe58c900164df14b630767dc1aaf57a4cd10b55c40897870e4889151c72ea9ad40abd0d32d7f94b1b0463fccd87de0f4f5ba2e312de42ce7
SSDEEP

768:StO0hqGbIiP//mdvsYSgLj/DVWmTMYq8Dfr7Vq3t40MSxjfLD+PHgkyMrj3DZ+/0:StCzIk/8ltnwOH1scY15uaCducQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000003964ab507edfc7f741d0cc273c0256f495706674887acb458fe3b0fe443ae78e000000000e800000000200002000000016447e1f97217d6577c87c0cb34a0dde206da059335094de407497f93a7749ec90000000fbd26b3fa465543e44354e1c27f2d6584d6fcc6ee165a37f20a5ecb30d5518309021878e81ce5b3a6ce0e9d9bb41b929e1f97e5f9d7462e1e9f236628b3299453b71bc2c06f3f6f68c6511bcd76b4a03440a04f7ea6c22e2437937b26d067c395001750853642c3b2f914f71f8dd288f655dc4f54478ce1f768894944115bcf6f099212a496af71a8acbb1aac24c1d8e40000000cbdc95a16d7946ab028231102ae384cbb2735eada659567c3308692e320b6fb7697cb66c5ecde9d48d27abbb46db6441b3dc78e7d7ea86efa4859a390566c5e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B287E01-A333-11EE-B754-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409677020"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70cbde554037da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000003b7ecf536ae6af43c21821d9fc503d67ab5c0f5bd187403c7501340ae61ac74000000000e80000000020000200000004d8d316621799d837801848348861b88306c7827200560884a1e2c59b7048ced2000000089463d07874406bccf37f228a4caac99d4ad8c8be7a91d199c88c3159e3d1b724000000069a541b88bf37fd5c74ea3b6f95672297af419f0b449f0422bb456e79be1b86a18eaaee258b45cad627ac2cd4ed1fa0481a03136188c9ab289c3e5d6ed5e287c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2124	2032	iexplore.exe	2
PID 2032 wrote to memory of 2124	2032	iexplore.exe	2
PID 2032 wrote to memory of 2124	2032	iexplore.exe	2
PID 2032 wrote to memory of 2124	2032	iexplore.exe	2

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\05ec602e2e082749606c32f42f4c42e5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8766715b8b2da94207ddb054315f6efd

SHA1
c01b5b5f918406c4c87d7abcf7fb451ccadf0499

SHA256
f88eab015404f9011a8697ae79c6c67608a5895971f6ba0c9491c9477e1bbf41

SHA512
1cb773bb30f79513c09590e9fbeb3d41ead243255a9a80afed318dcfda2d46c2a9e812a955058e6e797ee6bcdf7e52b3f4de73ff82b87950b5599dcf2bd93237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f9eec555bbefc3a0aef61a7655f7904

SHA1
ca193a3e024b3ae4a39d3c6e127ad895bebd5bf4

SHA256
5876e799643b79521a3361906aeeef26e4dd49d4c5460c78905f6ed192c2d4c4

SHA512
9ef280bfd9c92c66fd9a6d0aa494e188962fa23b83c3e7fac39eb69e47178fa3987032464be4b7db5c56750f7416aeb0cc366cc125f1c24d2f9ca6d5504e46e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bc7ade5c5d2b16c7c26a0b6e243943f

SHA1
e0218c21586f62e3ca7320214df1e43d6a6ca816

SHA256
78610cc8de3e9cef09b7feab2f9702365ad48cfa5f5027a48bb4520f942af6ab

SHA512
8b36b29bc853def4c5bbab31d975fe71fb751bf6bfae6437b0ee21a326f7955a15b032e70afdcded9d2e5a5da6daa87cd5aa449fbd2abb88a0c454cd2f7c2742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6a2f128bd48ea199f8981adefec590e

SHA1
ccc64fc0382cbd99f3d2bfde55c43a6870c3fa82

SHA256
372238af30231e3ecd532652c69f4bf8a0c9c541a2f600becdaa4aea42564987

SHA512
ee41ab538ea9cbcc010cbfd0219e99f053b204abbcf8d19e5e8bb67863147ad9f08818df848c21b9e7b2ada73dc5f51845c25776b8cbc7edc12d0f98f9ae8b46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ccf8a7b63ded2c9675033ba879548f8

SHA1
38c90b986219a8ae2a28eb34c2be61e19ef297f0

SHA256
a3b42da8dfea7d359d3de3f7f91702764b1fa543268cd2e67555fd1b202a62b0

SHA512
c1d292434bf924498670dea2a789ffd657ad3c39593d81b509c33d735690149b5fc90f948cd5db5693d09c07b0a2c1c25c4fb1cd814157da5e6c87be81761e1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b9e18e4165f13c2ad9261885cec41c4

SHA1
7d5b21f8e92c8830add7d3c5d4477fc9cf163bba

SHA256
9eace3ad7bcb16479811dc39d06e9a6824c859f66770082f3cfea7fe23be1066

SHA512
96f52b7d78da19c89f86eff8a556dab49d3baa1934a5bfec65fe3cbb69901418f04fd2e30ef3c65650d092333982e2ed3f36d929b0da8973a63a281c924a4631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c50c342e07812411606b05ddffce4ec9

SHA1
d9e017d846a6ec0077471b215cbe43dcd0270324

SHA256
b6809297e0967109b99a2fb9d1da7492d0b5d858b4419fa84d0ca5fdbae0d1e4

SHA512
7462180b4926496064e1696c48283b3281571cca8caa69c17699039034a19acaf5ab8d95dfa1bb77acf070df21d74da446a06cbd07a296c9d059b904f8c74446

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15fc7571a8129f08fe3be05514d31961

SHA1
d8174c33f9a632aec8585e2ef77440ff3a17e2be

SHA256
1832763885413df9c2d4aeca86a33a4f10899c17c119f12ab469d9435eab22f1

SHA512
9f7c6c960e533ccf69de1b7613e083dc62914501a8e2a8a5e2730bc1ab52c8296876654a3adac92b20f79f9f07104675342d76a7be944ea3f4257e84538a7738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
892fe5114139df598f60fcf132bafe2f

SHA1
d2cab0a2923b2bdf52f3ee0d0ca4824e640f7b7e

SHA256
e0cae3effb9db3ca68030a5ec9e9d9af51a678af38125e1127602e1aa5814701

SHA512
b88404b3842485a23719fb5bbb20938376dec1dc4162c966095fcf652c512b5f9e70e22fdc8e8d906e66d58facabf7d2b1a8a63c473da4a45a8cefb5dc0cd14f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c715bf9caafede94ed85d956061ecc2

SHA1
89be50409b8517dce903738ab06b2a1105ca8ddb

SHA256
2744f8b19c3209657e8510b88cc56bd245e474444cdf58d66c1498531ac9d952

SHA512
8346b6dbaa28dbb326afd6af513f3ffe6031401c8feb51c139487e5a0c59621f44bf79188f5feb78267d0c4f913166eddbe92cc6b25cd5a96cca3d2fe7b42420

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dcc84e9853331095fa50496a797c1f1

SHA1
c9fce1a70590d7f9e0177b21999e0f4db67efd86

SHA256
42f4c83254cda7a1d53ed587ccf0f6a9b699d791fbcf07049bacbce7ff74c2b0

SHA512
f259a4617660d27cfd14dad6984cb4d2b85d11f3f15691e6aef4f2446fd6e9eec8e2d93eae7899cbeb19c86038f8e373cea9cc3d10a3c66d86690af960919b50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ac2f3fe0b1ccd29eeaaf2691f20b9c5

SHA1
ed1e35b7bde438d94fc57b797be924d2d1928860

SHA256
f47dbaf5ccee618b5e3a551f0cf9b8676dfd073c10b93f1bbb7b43a273855628

SHA512
f8ebbaf597a0c6cf4240d743b7d5966926df8bdd34ccd55d3460a3adc2d92a02b78d7f7a0dfe10db56bab587bd4ebe69dc90b8acb00b63b816106c03a34b3b0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6785e82a31388d6b30e762f0acbe7c3

SHA1
5ebbd7ea4844767079b93ec07fe6e53a69e8b1cc

SHA256
b5f007933e4b495f9d1cedb6e91b67980f36a66b31e6ccb227e67c75ec9e9f36

SHA512
5c21ed265cea7d45ae9821e0c0e0b7777b55772e7d466aa425ec1d838ba34566cab18b23dc7b0da1be1efbc34d036fff8a5cebce2004c798bbb293c07bd1a71a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f58037c4d99ecef132a06b35c5e11a04

SHA1
381dd6ea1a0d822a13c0685af21e0f43612ac9e6

SHA256
bae63eb25a0e6c82c6badb2178d2b914a51bb3efed12063a3a9260d80353e970

SHA512
2a6102aae47f36b7e4b49087cee36c53bf27f20b4c76d95e19b87c3e8bcf01884706aa69f26123792d6518c528ef10556783037d19f3bb0b683459feb76f52e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab873B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar873C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit