e57913c7ae9acfb8ea88369cb8134c0242b6c0e38e4983e0de331d7999564e72

Analysis

max time kernel
148s
max time network
163s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

099bd0bca1b18cf6dc3edb5ecddb5b96.html
Size

31KB
MD5

099bd0bca1b18cf6dc3edb5ecddb5b96
SHA1

cf701da9ebb4aaa77fdcb50042617af4cc847163
SHA256

e57913c7ae9acfb8ea88369cb8134c0242b6c0e38e4983e0de331d7999564e72
SHA512

8ff27c24ee1e8ba965ecba3c1b3ddb817f682b525ff6060cc7bb451c1009d971d5962dfbc7f8f093f96cb95d702a1629f1e762ac2177e7077fbdf04e884a4b28
SSDEEP

768:jZ1xFrPeIL2qqDMGIWhWTG9mAm9bDw7CxFZNLxQWZa93UoEhaYTETyNJfjowCWW3:KIutYYHt3puK6FA5Tpijmbf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ec02e89138da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D624631-A485-11EE-8452-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000ac1e07a65a844783769fb8f5c86904232f683b82dcc5766d9cf1724210cb2b17000000000e8000000002000020000000d1526d29e47ae0cd7b99daf7e55b4f9d130b33c623b370e8678eda2e16b379842000000035ba7c93cc055c40a632f879a79b7c3a5e7a4daae106e556d8ee4b84495cd598400000001a56e1b2228e7ee5831ff4a8a2af21585aed50d4b26fc9f772546c8fdbec3e3ba2491a5b20ca19ba0830897d8c67a2615d4b689e291ac566c47573464cc56256	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000009d766ea58dffc1154f41172fd6b74527113a1649d5f6af9868c0aaeccbe5bd49000000000e8000000002000020000000bf97d2f84c00fd30fc9159f64825a2a8d47f6493b92ac82b75017a5bf92587a390000000bd6fd76fec4d6454df04b951a002d7a174547c7bd863b2ad9ebc94aa9d5de9187f7c0c58d6ddff8ded1747b27e9983dc45e29aeb7cc03ed36a1e572e3330ce8b5bc8a308a762fcd00eebc8dea676d7a17e4e56383141f154d7bce2e03e44c29d436fd469036846713945a7839cbfdc54a4e04cfa02c0c30b046c938e795fb0ba40054f6766cfaff26419c43b3ed440cf400000009a1aaef5fbe2ca5f1c873727a2d3536b7e981d29853720c29260c290ddaf2065505b23664603f315d39c0e159a8036ecbe62423f60a966bcfaecc929ea583743	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409822073"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1516	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1516	iexplore.exe
1516	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2684	1516	iexplore.exe	28
PID 1516 wrote to memory of 2684	1516	iexplore.exe	28
PID 1516 wrote to memory of 2684	1516	iexplore.exe	28
PID 1516 wrote to memory of 2684	1516	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\099bd0bca1b18cf6dc3edb5ecddb5b96.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86ef84427be1b61394c77932f66f7393

SHA1
fac1d03c27a1fdd16edba8f8a1cec7fd060a32ca

SHA256
63612c576e9633631d80db687da4e5521b0ad192289a3d0adcc5c1e79f52af8b

SHA512
7dc734531b6c581d8e3eef5d597b7384065dc9c505b1597f31f5026829731caccc5e76729487bfef870cb675e44f9ff319534adb83912186256e109af46b132f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88cdf7ab05d79a31ea56c79e57638abf

SHA1
1799b39108f09aea5c1501f91d8fd4502e6c4adb

SHA256
8f8fc82a89fa6aee1e464a80de4d8d250bfc4618d42679111e8984b94b8b27f9

SHA512
87722248617f814db817f1d1caad6fdbb81dd1caaf1c74cb988d30fa910b34b576e669fa1b815c5f5dc6a71f1e70cba47a1afa997c3ca5e83081a82d9137515e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a2f3129d7eec9672d9ca8d859af53bb

SHA1
58f05578f3f7ac059a84adcbdac86b5bed867aa4

SHA256
0c48e8bc7c102f8baeaaa5590480e12b5cca72b14949b21bf136f30927431656

SHA512
13a4b7e51971c9898a02bfef9108e6816dab025cbcf91e2b0c9de387fd2daae7c5b853d03a317f5cfc341c78e9dc34121dbba40801b65443ad4a2ca42eeea0fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73812bd3ccfd17d4c2375e594ff82f41

SHA1
adf6273056197d90bfe5be2fe74290f77deb0db6

SHA256
be6548c9e2fbfd05fdb2db29ad4e81f79360ef5d25c4fce15f59b69e690cc6ad

SHA512
3504fb5dbdb0dc01796e9c37410362caff374878b9e670252a55d9f63799fdb0694d97ff58daa3cc7de5f7b22e1c1f979836f66af9e810d627ec0fda49908864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a03c325ff3c0d67c2da026c8050fa86

SHA1
526701720b8e59749070ac9e89ea70d9e0012418

SHA256
91afb2f0a36c37afe0e1f972be2f0bdcaade75c444cdecc7ff9124bf3c0450e6

SHA512
1b23de009b748f7defdcf7cce4ce580fcfe87320752608877c881c2afc43d16a26376c3ff1f84ee8c002f277846646d74b85cd9c94a44c610355a44c3edf80ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f7c494da54002e239269e6a3a6d6772

SHA1
189e7e38abe7914b615e874d0d9fc345d80d8b6f

SHA256
8e1d30ad99d3ac0403648393e09e6add6d5960ab5d41d6b404c817562dfd958c

SHA512
c4f2b1f103b56ae5e6ccecbcfb6cd84a6e55583b92f666899105c1e1a37e00e8c5800f31951adb88872a8ec2d14e85c2967efb73962512661a549d1e5a9a53dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f359cdada54e593c883e33c4413a3bef

SHA1
558693af3c2cbf21eef26d4f35803856967981f9

SHA256
2f074fedd6f19d88099e51831c5fc406113499a681ddbdc70b8fb7ad061e66c9

SHA512
5fac3d31a0271a56c0523f608c1e99fc2a7cd9291c3ebd3b292f77bba3dca04d177ca197ccb758a30bd576b36619ba643a84e6170830c4cf7bbe10d1d31273e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14c2876230d8f23425b7254cfcea3727

SHA1
092bb30c95cbb181e8c347d8dc9f282e1d3f4736

SHA256
adc54b4ad427d5112082ca3b305dd91b4ce0a13f08f2f3e96ba47901dca3eacd

SHA512
0f3b11f195a27c91fcc792a0809cef3a7cd48242981b9f4a1a0e82611edc8737b5edc439e9b133866f89008114dffa32ae0675ecc47f79d67d3654cd6b813570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9a8b37abca6031bcb5d0e41d4b0d8ed

SHA1
9d1decd0d3e5404db207ac69db39e898191c36ec

SHA256
b50d937a125aaad51d08db029e11376a7a719b2944f341f9f4ccd6971bd5dc78

SHA512
2ca908e01b50754c29aec2b942ee830abccc673df96896056b68fdbe7f802de0ce1cac8265eabe558479981778a074fd48469c7a8f2b93bd8bb613eb8dd3ca50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1faba7e0b740dc56d2a0cf3b30feb88e

SHA1
da1931f84017e5dd01ab136f1c0dd1938f0a81ae

SHA256
d2c101a6d7198938d6133993aefa436b65b8df9b5d7aad64781aec866ed39e4a

SHA512
9f582403918b34b5f03154470e871448e7a9ffdc6aed63633980e18daa2f79bfce66a06d13fb8801a1c7e005d311647aa4a33f5efc4bbf0c4712ac3d4d82a521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c63b94066e5c4a65fb4b1f04b240892b

SHA1
17e4864988d88b380fbefb53846f8fffad85bab4

SHA256
f373ac429aef35fc189c59b033091d66c205179f9dde276305210e9072fe8ba4

SHA512
6d5dace5124d7e4863fc59bfe87405d5a66955443423eaae6d631b11fd302d8dabbb38b5f1dad65323bd8b30969a9a071d5d12f675bfaadc6319f89195b55959

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\f[1].txt

Filesize
34KB

MD5
3e47ef57df160664693a84aa6943a9c3

SHA1
2770e2c7f0b1f5d1b7210ec273d88f49ed5a416e

SHA256
a490f649cd5ef6c02a82668a15d665adc34ffc7a94979bc2edb89505df28da26

SHA512
904687d537bc0c935b6b98c2ff77d48a0f7b59d1f4380cd9f1113214b698b8e91842ed89272745779a92896c2a2866b67734f6eb1255e9c9fe54ccd0e7d0909f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC4F5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE0C2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit