e46e87879aa5a43f9629a2cc6534f6e6fd88eacaa5eacf77768a0f336717d60a

Analysis

max time kernel
146s
max time network
189s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0725c94be17425d7a011a16b56a147b5.html
Size

49KB
MD5

0725c94be17425d7a011a16b56a147b5
SHA1

2da8441c3102bfdf5941bcb67644add979bb42f4
SHA256

e46e87879aa5a43f9629a2cc6534f6e6fd88eacaa5eacf77768a0f336717d60a
SHA512

ed676ac516986dbc1233623ed263c8ca1ab35194d35d61fbc4b53e9ca5eea359f25af244bdd022b8c0b87f94805af274d1b5b78e6aa89a215790b442d34f63c3
SSDEEP

1536:Ry2rzXmCZ8SMhYdtk5jkl1CcAY+VmsXqivwLBpVBXMorWCXF/9AmXjVpAdUXFTWO:RHkSMhYdy5jkl1CcAY+VmsXdY9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 47 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000048de2c9a9420d9fc78b5cd50b20eb5bfeee45f913ef2447206cd222658c47c4000000000e800000000200002000000019c998e99aa198ff2eb767f49d95d5ddfbe6cb0b83a2378f63950f06b134e661900000008546e732c293d4f8507dfb49eab7ee7983b871a78c2a7bd6d2acfb1a2ca7cead31de82302587136032554f132e6bd99f14640229545e1295bee2b43c838356e63c332eb6826f3cbd48328602715d5d293d38254aa699d1df0be6b31e59dc68c91616ef52f41861a4002415306306b288713dc3c55657ecff9130b22e5f1c44c2a2f0cec49338a19861e9bafaf19479c040000000f6f814c9da7d5e8fb6a9db54b23e00e2f47fc448c8c94e2ee427aa594989414f4eecfd8d4e0d5a9bf8fa6e85de3a21266217ffd3cfc57ea5d31e1248f7790905	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000ff0c79c392f29d6861e40f19d1887d28fd6bf5233dc6f71c6e82fb95d7142912000000000e8000000002000020000000aefa4cef34fc1b809334a2a9af734facb4eefee13528e5b71b90c2904799789e20000000356a726adfcd7e6e58234aceb885c03068aba16c15a6ccfebc8a9a33d282891340000000cec975c16ea4909481bbae5fab9e349657dbdfb2ef6bc19c244289c9c65539027e6034f9e6e81ef66d7c9d6d96002e0025d61bcab9131a6d342b8da131ecc868	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409810438"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0f96be07638da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA55EA81-A469-11EE-B696-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2832	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2832	iexplore.exe
2832	iexplore.exe
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2960	2832	iexplore.exe	30
PID 2832 wrote to memory of 2960	2832	iexplore.exe	30
PID 2832 wrote to memory of 2960	2832	iexplore.exe	30
PID 2832 wrote to memory of 2960	2832	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0725c94be17425d7a011a16b56a147b5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2832 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
60fe01df86be2e5331b0cdbe86165686

SHA1
2a79f9713c3f192862ff80508062e64e8e0b29bd

SHA256
c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8

SHA512
ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
bd21789920f493365d85473078247d78

SHA1
a2b276bec57901b6775a971a94e7467682ec085e

SHA256
3629f70eb0447ee83fd32752671ee145f73906f6dd6ae6f2bbed1afc8e03c51b

SHA512
1ee5da8392748111fc70a5e8c54b1a45c2dc225283bfc4cf61bcaaaa7cb6f81e27c588ee2d5a5ad993c014ed0c188237b74b281d859f801cf07062e41c50716d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8072a9fda69717c750c54002ba26a7d4

SHA1
3283b918082ddd9c250d69c11d6f025a34c7d0bc

SHA256
6ee21ef7531dd4f2c935ff8fb8d77afc832eca2036c12e1a2c5f4fc65872c1ad

SHA512
b7bb5d81b655ceeef2a738f5a4a79d8ba6dd5015d1224fd69f2930227de91f3c8fc6bb8053a90a5bf4fb06b787ce3ed479ead3be4728de2c08db4672d1d2d9f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e688e2ad5769619b6f07431f7b8c7e3

SHA1
531d898b961f8b6ab4dc73f6675c610c20c65de9

SHA256
c5aa90a5886c38003dcae569971d41403876468cdb9e44f81bdad475580d1ede

SHA512
f714e150d3505128424326b27270c13d1a2214d52551f39e566547d130d6574c02342037e144492cb01a49311c38fc14e9c659a6926b3184b195319059b13b79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bb27f126c59d3a7576395c95f82eac4

SHA1
58a2152f81d1e829ae973685976add18c683d995

SHA256
b00d6b5dcc3e39b66fac32cd54132bfa26ed1c4094a767f87f36429c8302d00e

SHA512
9aecd74262605b7cb14f36965b77b61f0f0dfdb2e19f04ad1fe8f8cb1cc0fbbcacedf40ca71351e1bdfa6756a8c2426d6ee9d376b7b34e1482ae369908fdfce0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
936971904b98c7860cce5e5cd20f08ec

SHA1
401675d92c2552fc3ea5432b99da1cccdadb32e1

SHA256
b83c0f0667c79871cd5948272f666fed451511729776d7b71f3de329c9f83d07

SHA512
2f98ac4075c09a2e86a36a2b05895fa36be3d05abac6b3c766d0428994738b86522d7b75bee451f0d6de85872985d48cede46378b544c8f5820773ad8d3c58b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b927c3a0db6593f42814480dd880602b

SHA1
b72ddeeb0b3b17299483a7ac3f29bce324707b56

SHA256
9e7fe9c0666deabbbdebb99f0c2178d5848524bf4a78d34156c848aa90c0ae48

SHA512
a8eb9b2e95f39a0dc8762fc1cb8ef10cd6194c0cb76ac017001b0872381dc6e09aec92b4305399192dee5e2db8a0e28f03b39fce662423ccd272a136cd0162ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40717ee1f26c48387d9a9f816105e7c0

SHA1
958a8298ed05640f87a42f9103d3e44b14a69a78

SHA256
040953a2f9ec145d024b9acd737a94054159490b2936aa89cd141716d076a71b

SHA512
e62e303302fbb6739052f684889e194c083bf43e8dc1d74d1415aadc021b64a5e33443d87997b21bc01799bc371ff31505c6b1463d5eb7dcbaadafc5c6e52e72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
052e121abe30e8e5a5be77582c7c23da

SHA1
11268a913d6b0d9c36c49ac5a17bea79079c593f

SHA256
855dddf3b285466efb554c526d30c6191ceab012f6cec977b33d7336cf505b93

SHA512
c450cf7d30d7a8a1f622b524a3ee4a8ab23d7f67a00dde00d9e4fb0d83113d24b20ee20c3991ec5e5a7a069cec378f60035ddcba781cb8d90ddc791384b431fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e08b664f17d12bd2bcfd2a1b74ab005d

SHA1
ff0dc1dcc3bbef9a216b9883133af06d7464482e

SHA256
d5549a3186dd300cd41561f2d0daed679f2e1161510d00586134f4c919825566

SHA512
c9da68144538fcabd38c9e62c664bc3e8c7ec47e31f3c4ebd4e91a42facc6c1e37d776b848b17425164d49108ce848cd36ba404eb22ffd1ef15e615cf2c99b20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a182678b54dabf12b1059480d9849db6

SHA1
6ad568b77a105b4c136f24c07b1862249bd8d210

SHA256
e3112f03d42d5475ba205acf6e12fd8ba856bdf969eb3a7a40b51b9836b194c7

SHA512
16365c898c60bffd129290fd42fee6363e3c365c2c7e6c88919866a25e2ac0fb2744d3017c97fd2a3a7ee802767cab5b6247badbdee21c883c08f12fef015cfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f24377a08afc5e50357d63d05ae2dcd

SHA1
e8ec91261f11b46d9b61cf66cc340502b1133a17

SHA256
3eb69b7d3b6dae94718d03f80911749c2d4712067540f6783a34aa15a3a89ff9

SHA512
52343a66bc6601f4e4adb948c2ea8f4dbff7004d6200468beb6b8e7414160b27a1e9a377050f09d13cbeb1f2ea8e8ba71f179808a7ca59849e5be62092e2d721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ee05b0a78faa41e664dbd52f393c102

SHA1
dc8285eddae5eff07513946a99b9ba41d955e18b

SHA256
cc99803376312a16c6fe54b433398cb7465221b30da951ee35e09c9070adec6f

SHA512
53dff4c0d97e5f773737450bcf57b0867f5a0db871feedfb3b8fa52e4c201f8adb35c73c891c8f21857c364fc083d9e55ec665fa0880d601aa1063fdd19846f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF612.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF646.tmp

Filesize
75KB

MD5
7a6d14c4f6be38aadc27a33300d154e7

SHA1
9b1cba9c3e5516887abcbf5392128db8bf1f99fb

SHA256
daf6578ffb764d2c65049f19a139b1c27b857501c1153f90453b9b436a648f93

SHA512
b8185be0596b425d275d967a9d4014c79d2c9ddc423f3e6184d87b4ff6ef1cf2873ce2f969dd3fb39e29039f4bf31ebfa3e6a1c47d9478dbd1386c535b77d6c3

Download Submit