e63942950cb87156ee2c91efef12ac986d85cbd808b55c59a1a6f2d844273a9f

Analysis

max time kernel
134s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

156b21e996891e5a649bb0f99116e1cc.html
Size

40KB
MD5

156b21e996891e5a649bb0f99116e1cc
SHA1

ffe3186a28404d9f235ad9934a8562851678b8ce
SHA256

e63942950cb87156ee2c91efef12ac986d85cbd808b55c59a1a6f2d844273a9f
SHA512

1dc067f3e36bd4331c54ff04ec8c2c2c3fbf9abd6e5a7cd92e6290833cd9291747c4d2b67f4c1215b582670c89acd57b8439f8c3ea8e4ab8a656ace6854a3828
SSDEEP

384:SIrJ8AromsCyp4fjBhPmPiawm+PTTip2yeHip2SXr9+isU8c:SISWKMNPT96Ngc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407e70780c39da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000074eda842783baf024e143e187292fd099eefbbd9e8373dfc2467723f788644bf000000000e80000000020000200000006faa2dcb1e6bd3b892a63045341a7da356a115ca74f1946299df885d910dd9ee200000001fc0015220fd6daa17dd20d9f73ce256f2934a9f1dd8072184ffaa2789fde6e24000000043d4fa3b142f38139689a925e7e71d63375840ba3f1d2d535cf034b3569abbdf033e0791bbb88df60d1e06487c1decb27e465005bddfd5f3d5faac0edaecff1a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000d61b7494e056c79f7d8af409d4b20e7e91a2a98ed786ae97733a46e331b066ca000000000e800000000200002000000032e43813aeac08cf0385611f00fe896e8c0d8a17507f6a9b323afc0bc6c2f5cb90000000a868eefc5a345de68c49692d17a203630dcfe54a72985314f4730c8cb049cc8033a3202e75c346e99864e64540c1f83a831b28252b457b0a8b8e7daab0d4e6d0691677598a3961158a85ee6d179fce886a02c99d3ac644e16c7873ea1b0e1de3d1c4780c5edeab0de20c455c8df6a77180a5b413d07991e393341962091c75065ddf2fb5eaf4b5c86350417bcf2b113d40000000d90163e13fbc7ccde92c6eb891d14690dd94cf2a9a9a77d65732fa29a1a13a489089751ab491a39db0c8590b13f3c83bab0ce321b7e4eae0248da193da4d2ea1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9D04F6A1-A4FF-11EE-9305-4AE60EE50717} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409874698"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2380	2320	iexplore.exe	28
PID 2320 wrote to memory of 2380	2320	iexplore.exe	28
PID 2320 wrote to memory of 2380	2320	iexplore.exe	28
PID 2320 wrote to memory of 2380	2320	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\156b21e996891e5a649bb0f99116e1cc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f43c8df00ddfa724077c73f1c9908e4

SHA1
1589d8c29a69b72bffac486a4ae32000fb1c34f9

SHA256
34a15a81c8f8aa0ba25bbfa0fdfd00d3ab57ff57f98308e7d0654fda204e3ea6

SHA512
43d7a2ae452c90ab728f548057b21685640b3eaece0aeece4314ba9c47b9fe6bf5ccc5f73c3ad071771a7393d22099a9203d25e83ff1e8ee06a1f88c09c031b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb7a039402b023813a388eb023ccb22a

SHA1
55687fde25ba125dd79a6c6ad05b17d06a9e68c6

SHA256
10a3fa1b666a0341ce7ccb255efe7a68948181dc45297d425c5e5bf08ddbe0ba

SHA512
72513b8dec1938087599a4c20757fa1d8753160b5487e8e598a46a8648fb0bfcd8fc0e122133bd49d7571799b6c3cbbc405799a1e6bb3af1a231325bd5ccb175

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c4d3d35792916c01fa7153efc312166

SHA1
243a8c258fc5d83d92a53e6672e9b9723af41a2f

SHA256
5781002fc21e8a62dc33f7d5b626bf563a18b54c7d819aafdd52e2ba7edee6c4

SHA512
f5e3a79256b193884a656a573fe2245770a5e7acd241762139601aa36402192f5fa5ee2e355c7885ed3c9c4ac32cc0518bbb13b859de4f7280a4af79c3ddae4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6b69015117ed865e7f27bb0d26f1566

SHA1
dd6dad5df918555a70540fe8b36b11cbe15634e1

SHA256
2774d9f130de3259e63ea28e2d0bfd29fd76d5372fc061137fd8c8f6a9c89dfd

SHA512
92c5c13982cccf386361a227d2ab14e3eeda39c968835570829f12e61054a824f73c0d6095da58279b6c62717e802755e24dc22d91460fc97da6ac9af88ea24c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bf20e7cb7835e92f84b5f61740d71dd

SHA1
3d59fd322e05dbad587412cf2f283fa5e32ea8a3

SHA256
8e59fbf7e57fc9159ff366501768e579b35670a92927a8f7175436f575b040ca

SHA512
6c9b9fac0735346f99e4cab5c6884cd4d418fc3493c93f46bf8cf95a1f0bb3c31ee615af7567afd7c7ee6b3336d0c96c58527f105fdf4a47b5148441fc244858

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f1f187e9e71603e76ea722a7e72906d

SHA1
7e273fe6a639a62990dc25546b168338b2effab3

SHA256
d7dfe77d9d467e22c76dcbe217a28a11b7df3a49622054bf0142d3bcb755855a

SHA512
c021e3bf23c7c04c664bc26e3a51569035b63d24e1aa553989b70a7a57c5fe5bfa2944d005fc6b5b44b92e622d0b8ef72e9347c0bd1a417619fa7bbf6ba486c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
436c1463074bea51bdda8eef7288864d

SHA1
498feb00797d7e042345e135fba6c9ccb18f4342

SHA256
1f32fb1b38af29df3ee6bb749b0ba940197b0854bcfd4037abd9dc9b6d9fb029

SHA512
bfca1107cc8025f561e444c4459073a7b19c0aacf1032fd359d1ee008c56c0d5e8f48a5a0dccb956c9c982bc92e770abfde30aeed561564853d90c22ed49544c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49f40ae0722b6e2828843435672fffed

SHA1
0c46b1cbe3a71c1a23d55083bb103fae422ce595

SHA256
dc4619aa0b04e6be4b0db5ec8f8e6e1db639289178a72e55bf081ebf6567755d

SHA512
6e42e52bea977195dd12866aa83ab6cf9ef08c5bc0c66b507993b75148362e6ef7c8f3153aa0bae746e8af11618dcfa10dca29ec3b294fc8b69be5704d69fe4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c962994e9bad4ac036f7e46f7ebaadc8

SHA1
de872f98acf994a5aab1fe88196aa58b85e46015

SHA256
a98cac098f3074ab23d99bd63401d6943e19f66e2bcb7a14ddbe6518b3547f1c

SHA512
a912c5cf6bcd0381740d93583a49e0e9765bff4544ace856fa105416848b3c0db8c1181f5e0e5533b273d5e4493fca9b367384543a599d2547fe730b5623d712

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d5c887603cb73273f8911886e630b14

SHA1
9d3565edc6a0159a54a62522bd147d85b8bdf216

SHA256
ddd4faa196700e87a650e4ac2c0026ee9916a979c95233297d49f432f3380871

SHA512
6a07262bc3a27a893249e9392cedc3251258de1df2c35402db0fb4a2a15638c615d8f959fbd64cc810c1ac9d1f9812046f03dd64ae20ec46b3f9e863818ab608

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2219cfc23e8a7e733ea7a904728d8b25

SHA1
7b8f9489e708ee17119c71585c38403197392a96

SHA256
051ee2fe70444238f4cb3e31d83ee2c9ee3c6430ed6cf46330636c0d9f79fde6

SHA512
fb4bdbd3a3d94b43abb6e4916e0370f2e3824034691b7e50aed30de36db04cef21976849a7b5ef42b801df902dd888f27b402fc4d7c5cbbbb14a39e6323f713f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87cadef51ce252e21b4d0821379e1cf6

SHA1
3eb52dcbeb97dbb339231d1cf1e70ce7a4a7d3b8

SHA256
c3dcd2f9d0fef8b950a62a112d8d9b61e5a5ae3fda0b4a34e2136e96f1d74724

SHA512
fd702a69c02ce75ca3f3c5b5c0655a5a2f0e2cb80ae81deff0afa09d4bc63a2e9935ff73396d41eafb68cb671ad53adb0e92782d084e181f4a0c0019e4d60b36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2e9cc4f3121a7dd19a5f3c7050d6860

SHA1
00f8f40babb7ffc615e85882befcf8e685bbb060

SHA256
093e8bc29d481b7a76f13430d8af3922725791eedc85847605de3dfe27574bce

SHA512
be6d994c19234c21f875c2e23a784dd409872248f2ca47116298d21fd7a6a9a95a430aa268a3a1e145b0b9c286722dcb61cdf1daaa4bcf4e2bf2ae45a5ed81c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2BF2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C05.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit