e333cd92a610c96d2d7eade207da85390b7767a44e4575f3ef586fb43d9e3535

Analysis

max time kernel
117s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e5580bb42140f27231cd39bf2a1af78.html
Size

6KB
MD5

0e5580bb42140f27231cd39bf2a1af78
SHA1

f4afbfc9c1562b149bc2a9f4731c6726cf604a8e
SHA256

e333cd92a610c96d2d7eade207da85390b7767a44e4575f3ef586fb43d9e3535
SHA512

a397fe0d6902bd3608d9b227d6843eabc4cbed4225448a9e0bd24ad8cc1ecd7daa479a969616eb85e50b1d89babd6b1d545d23704e83a6b01f1860eee3e34af4
SSDEEP

96:uzVs+ux7PrVLLY1k9o84d12ef7CSTUrecEZ7ru7f:csz7PrVAYS/7b76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000d93e38b92ea8d4059db537e8103501e307d0b3e5abfb960fa1fa3eb30269b05e000000000e80000000020000200000009bca7fb5a6c09cf96e7e08ef99e49cb6b9ac3421a4290e09d44779695c308a9a20000000f622d0592051bf66674b82c46ae6a9a47e649839a72ee111ff6b4b355dd89fd5400000003521e81e3af3992aa9f82eeeb3b8191a718421dcf000cd01c925f0b623530b68859d415176a8cacfef5d40db349c4cc77e2a93a73ad6e3b674c1798a69f21c0f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000006459d0896d8d837df8372647419755fd8282d3f6931e7c220935855e7096652e000000000e800000000200002000000045c1a0aa0979fab0677cf96c840ced7af5fcb4d2c15a68b2c53f625ebff4b724900000008ea33ed4468d2916753825ee1bd483217148143b3b7c294994064c66bbcfb919105d1f01e428ff0c1c7882d0531f9fbe93a9b7f00ca222e842f7fc67f42b2ed670aea76bae20158f6f292862a8b3a3ad25db94251519f112e0d7123b995e7ccaaea7efbd27bbd682a4a28de310864972095e96bb4c998b7f038ba1b194e80cb788b40e96964cc4578e58cf54ce6220d84000000090db3ef4a8706a198034ea7ebc69cafc12224d2d12ebe3e5ba3833a1814e0b2c72b4c2672d32e3eb506bb32d318247c4b89602280527597c5608340e08c12c78	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409694425"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC9955E1-A35B-11EE-8646-6A1079A24C90} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70bfd6b46837da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	iexplore.exe
1728	iexplore.exe
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2632	1728	iexplore.exe	28
PID 1728 wrote to memory of 2632	1728	iexplore.exe	28
PID 1728 wrote to memory of 2632	1728	iexplore.exe	28
PID 1728 wrote to memory of 2632	1728	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e5580bb42140f27231cd39bf2a1af78.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef0e10698b68675538b4df05312de15e

SHA1
209e019f66fa288c08473648a779ed45645d965c

SHA256
121a1588e7715910c73cbcf0b432d8767ed2c3b15116a7a02bc8bfc8418fc73f

SHA512
049a8fb339b1b02f700a1362411399ae0e6ad76ea425c790f656e595b70950e877091506fcc346f947787ba498aa3a61939e8d11d03ecbb2d24653c93063d0ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
858e4873bc2ccfa9915253e8ffa84309

SHA1
218b4e4397ced74dcbd06e15392d257877ea72c3

SHA256
b1de67c032b958277884c5288d5000ec2cd5b4e085a13aef62288babb7f7365e

SHA512
cfbeafc90c50b2376ec1e53d25a5808e147256d12f8b11397f67945e9755979f598e931643c66dcff9a61d01e467ea85868f0382bb41a619440fe4f6318246c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e8023e434425a1f0f74eec2ca77105e

SHA1
4a2619402a79b28875fbacc64013140da8656df1

SHA256
e088e24322bac90742897852be8781f843b658aac92d30a82801c5d91acc47ac

SHA512
7f525987ca576144db06127e68b013aa88def6f90755e891f399f83961f1bbc46e7412adfb4fc7c4eaa8071bded35e5687294c72ad9fdcc8317c791f7d2b3f70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfb481e309105cf334baf67682723190

SHA1
6178ca35ddfa97fde340830570dd57c65bfaa992

SHA256
a0250ae82f147c58e268c77c8ebca901b7959c0f0ee6b8fbf549f8a87b2015c6

SHA512
8eba492cc5ce076b5c32335ccbe804b8e266dda46a1b9ada9cd989e5f46c3247821680015e11f1c4ab32c2ed440e9c287fd1a829b3245e6bf63a83095e6d49ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
208ce2377cfd3d59bcc2395fb3ab3152

SHA1
a3e7f86b9c4f29e4038496bfc3fa42083ed7fefa

SHA256
640a5a23a93d884b569e3e9a5284a4901aafa1e99993fe10e4abd02d99b11831

SHA512
3195d67b6919d17325a3d9f8a402811b11b89780c27fd2798b000e893065b40c530fabe7f18dff91bbb1ab7a53f6454bef826c586d57d649abd0c3decc316baf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
060e3a02f297dc90288efba898e7c1d7

SHA1
7512cc82aaabc8e8b474eb4b7299affc99f13822

SHA256
90cc2f22ffdf5004c2eb6e7a27a3a4fbafb2c19bcc1118c34e42345121d9098b

SHA512
d9aa35c664816f170880c3b86d9246ddf4c61653083e2cda4b436e3557e58affc599f06bef541d3c390cdb750816d733265e1cd9a90c45b46b20df6de5b9c161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
023dd69c7f01e62f9dc61ccdb7450d70

SHA1
b26e439e33153e0851cd087bfa661f15e173514f

SHA256
69834d9704506d709499e9f41ad264ab5aa0765dd145558ae1ca142e7116db87

SHA512
a5ecdb5023419b0bc48ee6ec2a41822756027bf1dbc45f6d0599accbb806eb9f987031d756f45762d4e55462f798f1a2bc079b1ca386a0218ff7a208b121bd20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edca7dc7acb59b948ca816a1de971fc0

SHA1
cba41daa44b0848213d8d7f7f4dc9cf57598a01c

SHA256
093fb398aaf58d1b19fe82f9ce89b6b9867a00771803e68ed9f13b5a91ce996c

SHA512
79b04032e64925a2ac53a187310abd677de7cbe8bebe054f67bd20f0504383a01ddee365bb6135729d4fa7a90d5b0ba9b9f56b03df2c7197b397dcc4cd66ad32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15c8832b9e3e5a9b254979b9df4a72bd

SHA1
5481e6b6b9fb233bbb4147fd97469ae3cc9df7a0

SHA256
fc6665568050d47dbd4e8ec3a44b576ca52eef49aa23d5b5092db82dcd230859

SHA512
87e94256884af6e244ac466440e6fd1f4b6826c85361bfe64701bb6a1ef43093bacd26b5685e86b7de239ba8f15e56d053a52cebfdff7f6fedbe5ca8711f6d78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71f928d01f00288e296c186165adc4fa

SHA1
0fe262a196ff302461b9ca686f866c4e4728828d

SHA256
beb71e3e87447fd53e9acdfc7c52e2895aac191c3be0e2dd3937ebf7a6769d7e

SHA512
d11501a0244081d67c1dc430e862160d19c700e062b3cc1141c48b8a94907789054d5f2b8360332a0607ff683edb238479015a16414c79c0be9766f917bc8f04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9472c698166f3376fc75f096ec3468e4

SHA1
e4cbd022db3e9155a4b11ee58473cddcde808ad5

SHA256
a170f3ecceeab7d1971a4de7fffad9f230ae49b9341385d453bdb2208dc60ef0

SHA512
710f47778f27c20f9fc19d44d69909c17aadd8f3c067d907c5ad68bf87ecde84e79880b56588df4819192333c0d5859f86ea52d7ee95d0dfdfb15830e25ce035

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab87E6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar97C3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit