a9b49049c54312c5886ba6d43d1add39d6e34716c98fe333977f4be0bf2c33e9

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

069f2df850ac10a2e3c20d157b595eaf.html
Size

1KB
MD5

069f2df850ac10a2e3c20d157b595eaf
SHA1

19bdc61a111c96a66f624d427aabc77a0480e5a5
SHA256

a9b49049c54312c5886ba6d43d1add39d6e34716c98fe333977f4be0bf2c33e9
SHA512

3c0b46b9f3c1bc8c7a788409419ef98a3b45e7d80efdbf986fd35cc24aed4ff2233343161b77aa2d60785dbefa1d9f4c5804753efe6fdb0dfad7c9b543e3c635

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000ce57ba5a451b133f6b81cd2558b3b407380adef02bdb4af814194fca0fb6373c000000000e80000000020000200000005ba9a8dbb7ec6110fc6d468f7c975685d60ebcb3264f07ed8f8d43207739eb3e20000000cd08c6c7fa024ee74e4121026d2ec9dd6877943b83ac03df2bc5b32c936532f04000000086e3a26c2c547775eebe12f6652ac15116edb4b5e4373313686c3671f27f998902b1b918a670201d60e1746c52c67e8b9df2005f2ea4e355500b24fb96138327	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0385FED1-A337-11EE-B908-CA8D9A91D956} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409678590"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000a067ff050637620a9a90b114bf5deb48e2cb825b73692f64661dfec486725c68000000000e80000000020000200000002d25020137bb64f3de056720a3cda7aa38aefad4249fa83401fdc4da8e3085369000000065b8414ccbb04def669b717c4b79e600b900ee5b1507d7798258ae33c1ea17dab3f7bc43dbeceb4d030dfb35661ee4ab2f5b0f22272aef24bd62925c3efc131f9a265e6d9e91c9f902a3e9fa7a1cf111333d54ed7989b855ba79a2d409fe4626620b52d8cdb2a4679d408179a8930609c0a03059fc1755c1b9e2de98c050cfb8ba04aa81c1a735f3a79422e281a1406e400000001eacbb508d14ab678721375ed7cc5e2a07d991d4a8cb0078a84721e36d1aa7b8d538764e39e28fa266d2e6e17d61b1f5869d102f8544a4a610f2343bb8c41b61	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e03005f74337da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1336	iexplore.exe
1336	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 3020	1336	iexplore.exe	16
PID 1336 wrote to memory of 3020	1336	iexplore.exe	16
PID 1336 wrote to memory of 3020	1336	iexplore.exe	16
PID 1336 wrote to memory of 3020	1336	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\069f2df850ac10a2e3c20d157b595eaf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
531714eac4d1ad53614ac85d787c255d

SHA1
c8a5272ea6461d823a30a6a6634e7c8895176963

SHA256
0bcd508d9e87d7ab4d89255834effbb757f7a7efb40f7f129e265e2dad1302eb

SHA512
72701b6b78de7704bdea7072a954b15c6ba9adc9b3e27fc3c69dcf812199c6d240ff6e955cf44255b88cef1d302999dc6e8324e61593ac6ffcebf01a0dc8522d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
203ade496404a4d35ebec1f727cf82a3

SHA1
77991370ff7d737a21207474502db217ac67d0c5

SHA256
654e7a9f872476fd3154e9ade4cf8043f1c3006f5669d3dcd309160262f9db28

SHA512
c77a960fad3c75483714b8eb3278a0e8eddd1c84c0a002ec6b43a99ef6a66f0a6bbb21fb679fe31f42035283caaf75c30f3f015ae7b1b8a8ba8c2cfaac78de69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b259e96505a560b08127ce76e7cfe528

SHA1
ecb1d0a92030827753b30d837186e4e37ae83080

SHA256
aa3d8a1d051ad60af8fa5529d79079b5af22d5a572bb1806ed9cdaff7e83b17b

SHA512
b8a67fb6544f22d91b3e9b1932f81d6d1e0f9ebb37341f03b9c41b6d883081d278d095f1f3e0522e482bb0c8c7dc13c650f47ab53742450513a3b345b4ce6245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1af4ea9359ffbcc3c494e5c76386085

SHA1
ec8f4cf72f58fe5d58e014744fc9e0b5740929ca

SHA256
02722c451c85c73ef56545207d5d70eda558a2f6e09cc5aca617401150c9beb4

SHA512
1ec264d7e8e6922300f1fd65f75d0014bf8e3258a0eb7a058f7bceef43b8cb31c8133fa28a81d3b4329c916aeb814aa3e94594671f94fbd48ae47c1ba3d74b51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0936761dcbaf180ff7aecb1bd1609b80

SHA1
f14a625d8385c37de57925d850b81e92df7de8b0

SHA256
d13aba7e9bd52bd01e094bee47cfaee33d46563873fe6d31ad19847070f011ba

SHA512
f959d25bd187ea97244003aeeb2e3141f6509e7cacfbffca5993f69f5a54f16c4b98fca790fdbdc4126e139a5ce300560bb93c6b9c5fb857c906e10c4edcf310

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33b5dabf08069a520fea158cba6e55e7

SHA1
c6070e1d4ed5e5cb7b9a9ac19288327408f02688

SHA256
bba3e4fb225aa29f4364ffd2674230a8d0d3d86b64ca70c6939948b9ce13ff0b

SHA512
d6f2813df270ca2a8e8360eefdd6730fcab37c07d7b260fddef59e257b4615bb6b1ab87f743524d9476cf786b16cd935ee9234259cec973ca1e0887753194c4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
566f99fcc59cf2e5cacf8f2eab6e02f6

SHA1
95c2f59b569e9669b99f4af898b0ae54cd7e04de

SHA256
b1b6e5e3a7db7ddba897f963eed1c830973446c66fd285f757d02ae10e903ff5

SHA512
94c1da25630963ff4437341df083e78cdd6540cbe4a7a44ddc5fa5219e9b165922ce8672feee9f7eedb4b87dc234f6aec8e883046d6383dfbd0348d9d441f996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a819cd48f745e100943e91ea2809f463

SHA1
a059ae78453e9ec0f5a46ae5d0100610d3edc693

SHA256
c7cf9a3eefb99b6d6fc192e1307daf9f2cb088f2e2c1074352d333814903dc54

SHA512
3d0cc9955e9024186801b4dda9073a563b9c940d44026e0f263eb8288579f4e04066e7242f6dedc6ecd14cfe9cb66323e5ccc29fdb8912f030932dad48171245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3331cb97194954766f993fc76057caa

SHA1
e1ee155374600c7866ff3d902c7a864cd812371d

SHA256
995f245bace2bdce299408a11bc7622462f755fd8ad3b07aed724b896fa4313d

SHA512
287b8642036766df4bbcadba71423836002b6840b19984756fc4ba1f0b662a52114313d76c2aa0cbdf74fcb9429e250a5c4f69eaf6c38ba2a3f03e0be2d88415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e13f47d890f61d77166c60f48e1dd715

SHA1
e511340c127192b1299f77ad98b4d4cd9c2f7598

SHA256
2d5913398b822eef3a9e06e984cdb50f1aafe1e9da80ece4b17bfdf356a676a1

SHA512
98af6877eeb8cb61c1c8c4240bcdeaeea4eb139fab8a7ffafd8cadbc4611ef9da63fe48b000682eec8eff9c691213553c848c3b7a2af55c206a8156107b0e425

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33

Filesize
406B

MD5
9926d46afc75a5c2dff2b3caed2074e7

SHA1
a35cb50ce94f2a4ac0f2a3e8155ae133e5d214ef

SHA256
84f4171d837513e6719ad6723db8ab3dc98e01b4665456f74d4eec5991181ddf

SHA512
5a0c72b2c58cf603fe77c32fd5c409324aff1dde5b314d5599e199a2ac705952099a3b5f1998affa4ed57c1d0e31575c282ed1b90291a35ea100c24c849b72af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
dafb1da8896c2a2d6c913d900ae7a930

SHA1
35b67dfe6cd81e32677e6a6bb746004e8add7941

SHA256
eaf24a4b2ebe65aa5e0ac5a8a4587c6dc38dca9bca967bbc4ceeefeb54a134fe

SHA512
ff0638db579488be3ce0dd420200aefd59f633be921a56718e8367b86e30a10170a759a3399b9b420a090e4ebd24bab9eb3d0d3c767e42d7f96e6d056c1aee3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFLWQ602\recaptcha__en[1].js

Filesize
502KB

MD5
37c6af40dd48a63fcc1be84eaaf44f05

SHA1
1d708ace806d9e78a21f2a5f89424372e249f718

SHA256
daf20b4dbc2ee9cc700e99c7be570105ecaf649d9c044adb62a2098cf4662d24

SHA512
a159bf35fc7f6efdbe911b2f24019dca5907db8cf9ba516bf18e3a228009055bcd9b26a3486823d56eacc391a3e0cc4ae917607bd95a3ad2f02676430de03e07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\styles__ltr[1].css

Filesize
55KB

MD5
eb4bc511f79f7a1573b45f5775b3a99b

SHA1
d910fb51ad7316aa54f055079374574698e74b35

SHA256
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

SHA512
ec9bdf1c91b6262b183fd23f640eac22016d1f42db631380676ed34b962e01badda91f9cbdfa189b42fe3182a992f1b95a7353af41e41b2d6e1dab17e87637a0

Download Submit