e9558cc6b71dd9f4f940e0f1d599f26e2e34120e7dae2a922be5e4701975b312

Analysis

max time kernel
119s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09cafc618dab1b4c58227348a8544d9c.html
Size

11KB
MD5

09cafc618dab1b4c58227348a8544d9c
SHA1

5437cc7c696a9ba29bb8d5b622c4b4341740cea7
SHA256

e9558cc6b71dd9f4f940e0f1d599f26e2e34120e7dae2a922be5e4701975b312
SHA512

b427cb1b4d6f393fab7789216fd0d58169dd9056688b74758b87b7ff08de7c66eedcb6d3e699825801f8fc6cec4b6972cb6542bebfb5a27fd276ef25e55a549b
SSDEEP

96:uzVs+ux7v9LLY1k9o84d12ef7CSTUnGT/k1+pEooYPiTe4nsjuFsrlVHcEZ7ru7f:csz7v9AYS/62nATeau88PHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d7b779f95b59fd4025d2d80b9771dbc9f90e5bd33549f77c1b78d6f08f76f12b000000000e8000000002000020000000e025399ffce8f3d28853b99c11f0291c92a7843d61e14ca833b81012db56b1a790000000c23d25cb43b85abe8617817ed88fac263d6ca5b68c3dcb1000acfbc907e1edf72f51f959aef0552c2c900e498e0adb7f8ca14518eb5a7f995ab3b6260c9e32df4bb346189c7c6a453decded80cbbcce1dbe880efb1f77e328ae03f836240168582bb0369ae408d006a9d96d98db6221a1a25d17afc9cd7259b6799b8e07cb16797dbb13c070586b0c756384fb51acd404000000018e95a80db2d764253a9cd34ff39bc00fa6a758ea1cf16469996da835e1f6b3177458aa2645350f546f65d3fd4766afdb8745a6036764b57799485bad296d89d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409685361"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000418d3239b561507daebfb70d35fe1f91370f9aa591e276172d2c31f172d557e9000000000e800000000200002000000006b95d8e6dc8c8dc504da83fd7e81435577e68835d39cbb0b226cb00ed877bb42000000025beff7277c470f07afc2e36ef339b744026dc1fbd1c751f754112300244637840000000c584fe68b5bdff775876670c82f21528c332720666b97c8758b0591e5d310315c5ebcd958a08ff50fae5aba025d34a701cd2a2d3e3512b59daebdacf5ebb2c80	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e7da975337da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFCBC9D1-A346-11EE-AC0C-EAAD54D9E991} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2476	2096	iexplore.exe	28
PID 2096 wrote to memory of 2476	2096	iexplore.exe	28
PID 2096 wrote to memory of 2476	2096	iexplore.exe	28
PID 2096 wrote to memory of 2476	2096	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\09cafc618dab1b4c58227348a8544d9c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d7cf4ef447e217e32f45bc80513014e

SHA1
572dd078ce11c17bbec01571ee107e77d6ef0b7a

SHA256
7961d1785471138041fd81ed2b1bc9d1fba780fa0788f4e48899282fba5fcbdb

SHA512
6269c51a8d8c50642dc5e6c8d4478cb2f330d0e6d2ff084a7c2005c6d5f550ca5fda5606458db1e8adbf9c1e1f64e9b6fbd195579984e7ec4dfcdf5cf0b75232

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79eaf265c5f5b337f171f429bb5c99a1

SHA1
66c2a46512f785083f11448fa90704625f123373

SHA256
b123b32192cea8a5bb09c70eecf828fec064cb5615121b6809a2369da1131cc1

SHA512
850562cf954e2795be095734dcbe2de5fb2075e84be113d9d2d95d95bbbc8a7a1c92583d5285d92f6bc0f152ff50a782db714d514a29988ad3b5f426deb7450c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
138b398055b7bafff81e69ccdece8934

SHA1
594a8b6e7616dee5084f9e285b0f1ca709a3679a

SHA256
3a8f6767f8150560a1edff954910b230308f0cadf2c2e1de36b7d4419f184070

SHA512
fcecbde4f55ef63619c67eb05a2ea0a3328791892c1b153942ff420d384ffaf11af4eb124e937a86f9543aa99b0d6f335a1c29814aea78d7991ae3313e0de3a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e15cefd838b2f4e92e26408c4dc83645

SHA1
393e927f7a05c1abc3d6b54bed7ccdd2203b899c

SHA256
ba6f67453caa47b54acbe66a9c8eef3ec66ebfd92aec6dd343865786a8e43cca

SHA512
f97ae0c0e841cdcda9b3d9cefe50ad8e7a78352323a54fdbc997f00b95dfef4622b546a924a951b351e396222836d9db34a08ae704fc93f8e112e4ff4dcb1d51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b6328334c379c3fee0bfabbbe63b2ba

SHA1
063cef916f4a4a65e9cee64424b91ff46fdcc090

SHA256
e1386f5854fe9f21906febec085babe65ac22e29a6626b12ac426c70d41dc1d4

SHA512
4ac5811c96f7e512418317c970b95be661ee6763541e9518112b067f18307022afc09c694dce0ea201b24549f259a599cdc60471a0af18e3eee0dedf51c5ba6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb9013d56854ad4c1c31648c26b744b3

SHA1
8bd59d7915054cb8bc71978cd5e3305817d55022

SHA256
e383480bce72f27230cd61bb7a3da8b6c95efc2d6d2a79efc6e9d29d7ab40c37

SHA512
7f497bebe79c6f2dedac969f87145c91523e34f19f8c675c58f84d7a11d4e913bfba65550536fdaa166687ee77d13778a63be735b3ec1e555347315ac9625068

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42e2b2e204e40cffdc2a82c4da24449d

SHA1
90547a9dd9f2efccacb8beffcf73f1f28849424f

SHA256
18e2d299d99ee8ac9ea43e19aaa728f331813256f9e79546e8c5175a7fd312bf

SHA512
a529c8dd1c38860025cb8e3dfadd5c8bce34b8d501fdd3b02ac06efd545f7bc2845c8ecd953be50243d8045574c6d5f299b5f17965411833ddcdd7598da31210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5d95c01f7c56760baa32efa2d4fdb33

SHA1
4a3393d6a48408c60bcb4b73cf38c9a4b4053bc5

SHA256
d001642669afbd120302120cfc14f761399003615bd12902e0249f7fdb71e47b

SHA512
71c0cfc647af5337e5b954d9a0f45900b6da97b816f0211a07260fb8128158b9cf4a0e6feb5995a2634eda693fd8c6725dc5ac4cb1769ece8650bca1abf070ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4de4e7b034db7726ec7eabc911a6c4d

SHA1
94c4c4e8464c485143a7bba90b7a16f799e272a6

SHA256
3cdccb2f6c808b44e219aef7b40166610e080b48e77d0eed7b391123ed0ae142

SHA512
68c49933f5692742f844108d91979e761a937bcc7a85b517b3f5134b91630c01d1757c240475d48e0b0d27edf030bf6479008f82b6e4c2b70875325c638fd47b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
881b44f140c299a4221e0592ea568d94

SHA1
19527c7235c7a4f0ef8ddeeea68d50bf744652c5

SHA256
65720720a81595bd2b504ea1455a4e2f9f672e606f2360acbf586910b76d7306

SHA512
f88e2f9bc0f2c486c8986b8f583141efc26110a517f42faa60fa7cd65870568e032b801c34567322496248280c7ebaf57b452d0eb6f97aecb74fef23e785d484

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f31ad5e4ecb40b26bb2c239f0bd15c16

SHA1
7e579ed79bd0910d4e80db860e4a9b61b4ecaca1

SHA256
78eef3d071877f6413b4883c1f3ae932719a7c4218c32be92fa7eace62bebb91

SHA512
19bc524aa9cb1bd84e4538660731c8bb605fd64f6419cab25de80e48de94a2137888d9dc26e303e38f9aa69b0d488ce4a743725bda2d3fe692ed2f8b39a54f29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95873e819cc8800d9b4dd031cb80eb1b

SHA1
1bb2a13ed818e7d52b09f8ed99408a55e1fb2db9

SHA256
b1579c9ce146138d3e994f959242dd6cafe8fb38858b976192ef819f869c9292

SHA512
1e025d42a6ba49292e436e0e3397ef1233deccc8b3654f9c1ea7b0081a0f99f68996f90e1d4a8101b3a9c6ba22cf4052d3f15ea3ac43ca8e7e895467aeea4875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ab51e6d20ca90c43a065df005534a2e

SHA1
a77091b8b92fc78595e54825688b8da30a4c7d93

SHA256
9befd717a1656575c6dcf1f82b8002cef3f7c44f5fe9ab4259459074cf4ed6bd

SHA512
1d9e6f4c141cb8db7eb80e67a468d700a2eaebc8103e1cd4789dfec675d29810cb49fd38da946b6098a7d56caf7ea5ae476e80433c893959e8cd62552a3d6b60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38279bd11fe20a33c889a02d7e26773a

SHA1
d7b5ad4bcdd7b1f623bb1eceebca6f08fa0ab9d9

SHA256
d740d3a66493f02dc24b954351921fe7f1ffe1727c991f0540751db8d22bb010

SHA512
d840052bc4abd330c85d1e9b1a4c28b7244156d8d91d9bb208a9a7ef88b91d406ed45a74bb9d153b61871ddf682be4f0e99f7bb6579b60d07f432513ae121c18

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab89CC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A99.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit