c57ab792312840cce90c36c3dee8221988f6017c7545849c5ff9df515c10b97c

Analysis

max time kernel
139s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

13aa9653eb20fd9e7577bfdfeedf99d0.html
Size

39KB
MD5

13aa9653eb20fd9e7577bfdfeedf99d0
SHA1

0cd108bc77fd7ef6e837e3d403608c18466aa1a6
SHA256

c57ab792312840cce90c36c3dee8221988f6017c7545849c5ff9df515c10b97c
SHA512

c84ccb64c8f5ac892f920926ccf4f6e11f5f1efdfd305a35d09dc0e9e012cadd1b0d0c3368c62e77c64f616784e979206aab6cc32487c3ff3ebd5c1c311cebab
SSDEEP

384:/rrb3JGbnukKVS65uKgruuhQdtD4ZX2e6LQ2Jz3KoQL4Ow9HgwALWAj77R2SJvQy:/OKP5ng4tDaGeEPJzaoQL4v9uz12S6y

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2CA1001-A4EC-11EE-BE60-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000003dfa70a19e7af5504bfd0cfaf525dd5f2d19b9bbb91db3b85b2ddef8cece6885000000000e8000000002000020000000a1c784a7f54e9d46fb4f5aa75c337f944521dd10cf237a702c7451cfe352ee2690000000f67767387d185dee8acf5d4aaedcc25ed69591e1dbeb8f64245c604c08fd1443ab300862b6f1ab43429ba38f619d901e3674b55e804355276bf78ce432af49654f04000b445e1d736076bdabdeb5401aecc906fd8f4bef7b6fde179481a9e863729b9fdff2f8c1a28ecd248d2b1b8dfdeda84e4d069e5923d8e491a0a017e445fa230f7b33e18186756a2ad42befc2ac40000000312e4e89f9ccdc7c5222012826debd6055b339b4c62f2be29c51cf32a2c0040278b63dd68858278c3b8d684a69272f4c69a07875e99f9daffeaa4f45511f14e5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409866575"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000006efe6ee0aca9935c786a5a1fff2afc4fb35f7646308427065492b5f0409e111c000000000e8000000002000020000000128b7d47a86defbf4b30c10f0ab9b543a52e8012d946309f35eaab9434e06ef3200000005bdb6d306dcb6302511992da95e303e26df1f8a2552f7e3496efca3c84088c9340000000d786fbef114dc76d39c52e24d38817fecfe5c6bc5a21539fb4b25671cbb605d487c74dae3d1fb09b703864be9a41ce163f6227a8af18d648b65cd3861dddae87	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c15394f938da01	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2280	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2040	iexplore.exe
2040	iexplore.exe
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2280	2040	iexplore.exe	28
PID 2040 wrote to memory of 2280	2040	iexplore.exe	28
PID 2040 wrote to memory of 2280	2040	iexplore.exe	28
PID 2040 wrote to memory of 2280	2040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13aa9653eb20fd9e7577bfdfeedf99d0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
3c4792ead59fe6538329c1a375de28c1

SHA1
041fcd353eb1830a08e060606b72c61a2ee434e7

SHA256
1f673e580daa5b0943520e86a6dc96d672aa637cc34f90172a8dd7391f637cbc

SHA512
61f6b03ac30a600d955cfdcc51406edcfe1a6416023a6fcf50c7e0f73093a84bdc42059e9e8b5ccf7284897580a1cb00a2f578eaf9ac35aa38ae8ae917c22e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
df674d4e499967722c25b9e12983c826

SHA1
ad7eb914848e40d2be721e3fe4f2fa40e0184588

SHA256
cbf57bfa790b86ae48324e5dbdaaccfad5fd2988789c49742c057e7827aec05e

SHA512
f0d2e41ece79beb04533e20349661bf8bc83e8e2fafd4f2c59ee490d3869b58bdae22d611f7a3e6c18fa7c8cdd0661d951d872b0dc03bf82d4d7d673393fedc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8ff20ed8604ce181d5a2d1ebf791af1

SHA1
8da5e05bb9d4b4b89348f565d725cb5e9c275072

SHA256
0ae183ed430c251793fd1a1cc94c3eed1abe8bb61a52b24b4055d4230281966b

SHA512
6370270561879cf40741fecaa57d21eda74505cbdc1ebca60f24ae1611f0d412637ee5f504fbfe5ea6c17fbb53caa6aa5640b57b851eb26831cd5a6ab7661d78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a60018ec03630d29e5e0f44ada8bd8f

SHA1
893a0905ad6ba705e320ad2bb735a025bdf4d11a

SHA256
8d64c89fd0c2397b0fcd520a220d06839d345fe6f878602cb7f7f948e9ef8b3f

SHA512
1757b02c38f23552f595fb9381aafce0c6192057daaa103c89931a768347a558594af5cee47800eb0f0e27460c2aca93bc1694b3950b2280ad29600735a02bc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
626e9bf3ceffaa22bf99332ee0ea524b

SHA1
9fec7223a1b6528ea2a01d61ad0e17366d2232a1

SHA256
2f4c6f5a248ade54492f11b0b7e3a20ea43a7326b4916c381f86557ead6f2ac7

SHA512
2ba0392b3282ff36cc804e06546926424cb51344a24586405febe103ac2dbc95318a91726e5fee1ec233aad46edfa9c3038a5aa9dddf9d114e7f0a3359eec2d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
637536dd7bb19a58f3f0c69c3bd72132

SHA1
9cb5529081862f39e3bd9797e0452d10ec57302d

SHA256
8c70864e9609d68fd019f2b05a12f98f06e6d51cf938fa1eedcf28c3b0038548

SHA512
39a2c369b6f3d239487071967e925be0fc55cd542eda7c9130a4ec357fb50f74d527c70076331689b70bdf90f1bf6fc1c386629ee8670c4058000d2c52864b24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
754b89b5c1e81eee6c129eee95b578c4

SHA1
dbb705e1d3f64f1665dd5924b19e92699c47ea50

SHA256
4618de19876ce4bbed5e6d0fb213e3672433ae4d4b59cb3aa0449837fca6549e

SHA512
daa7f1e2bc59374ffbd527dd2a67ab642d3ab903f2c3424ce53dbc3b47706495b28da11112d63c99782400d8fc61119ed205780d0ecab08f13106bf9ca00214a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe8e353239537ad0447cd1a050863ebf

SHA1
2574f4d93ceb367ac63c027530529ff34b4b7acd

SHA256
906a67cfad90e83c6a1b87f961fcd248da30a7a96b2b3bda140e553e0fc1a6be

SHA512
72b1fb952e6db33cbbccfd4a043ed3e335418bbe0f300a7d424c901c576cb6a434ce618b0ea3748d45db889820ceb2d7393fcdff13a15458507e2bca5e22d0ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10abde48a92f4ded7be1fbc2da2a1d3a

SHA1
1cf2acde86bbb9b047bdae7412bf621926d1038f

SHA256
6e2db837ae5a880f683bcca7d5eefb4a8e682b8b6b97c624f581a1f25474dd19

SHA512
c7bc2a1df52f74f40c7f0606e58d82cc27be9e8a4401363a242af36a96e2c8f05b3ba5b0655c2c5635beefba5503f7a04239bba7e4eb077194eb643fc5aa91a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed18cb835912835fb140e8e2e0734c88

SHA1
e1f3fb257527903a11db8501163c6c325247dfd5

SHA256
ed635718f592899fe1fac051c83b5ff2ad304a707c02a756538f2bd5c4858b1f

SHA512
9fff09b482405d02748be4fcbe8b640de49d19eb014d760a3846344697210c54bf96c4ec612b562269e696e73825da13c052b97110a88a88315f670bb32b3187

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A89I98IL\cb=gapi[1].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U1J1BPYJ\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAF93.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF94.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit