e866e9be368752b79269ea9d2a81de6d5a10e0855b52c963bed69feff69540f3

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

16aa847dd2707077cac3e036f75e7211.html
Size

6KB
MD5

16aa847dd2707077cac3e036f75e7211
SHA1

ab96e0bea96ccaf9af316666fd929730dd6c5f71
SHA256

e866e9be368752b79269ea9d2a81de6d5a10e0855b52c963bed69feff69540f3
SHA512

8fdcc4dec6dfa3317732d5977e1a2b2617c7475ff5b39b3bed941950c79e9a3db8bc0e10ce8030ce8a7797e8eb58e1f71b55b179385fcf0e7d73a556db02ae57
SSDEEP

96:uzVs+ux7AYLLY1k9o84d12ef7CSTUQqY/6/NcEZ7ru7f:csz7AYAYS/f4Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409880413"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE2E7A31-A50C-11EE-AE7F-C2500A176F17} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04a32dc1939da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000002e9826066c31a5b8f9b1d7f6c2cbe792a7d3d7a197658a84f3cde87ca273f80a000000000e800000000200002000000044ba501b838b5401d1f6689d2c7d4f3f93bf13126e76f6588ab9ce9a2cc78f2d2000000027fdf21d14ffd212fafe31600047ae6dfdbf5506df4b09751f49ed51107445df400000003cc764f7a367b882931c7ce7ea00fa638c25004a93ae972e18b08c3c9942d36ccc7c6917bb0ee9ef563bbf691d8bae68df42063b2fd3f2f490386b79e9e33c1f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000126801197c37323ed42ea5b77da3b93a0c3e756a804fb3cf32ff9a8f6791820e000000000e800000000200002000000049d0f03770ba10a353b6f585634c8cd8729f64b753d58d4812983423868b97e790000000f19caca4fcfec09cf74ef7a858483eae54edda3c21bc8794650b36d25f69b02d05be740c75118ddd0490e73dcb1be28c2018253fea1d6d7827699d21a4f948fbab3a036b603ccc3a7a21e46473a7cd73c60335b459a58f303bdc96c10ef7547f61383cfb9f0c9cab973f34908bc94418c3348ef7ea65cf5588a0615b30a142f82473851effc1b6c0d15d3a41b87523294000000031a37b630e2ed2fdb9da3d6f1c406c5b86088a0e96ca6018367164d1f9bb0aa58be9f9bba46437ae63e0183383f042de9666d9113d64cfc9cd684f0c5ffe33ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
240	iexplore.exe
240	iexplore.exe
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 2408	240	iexplore.exe	28
PID 240 wrote to memory of 2408	240	iexplore.exe	28
PID 240 wrote to memory of 2408	240	iexplore.exe	28
PID 240 wrote to memory of 2408	240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\16aa847dd2707077cac3e036f75e7211.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a20fc18d50f43bd4b5556e8327abb95

SHA1
a52171bcec1fda1a4ee45f950d3cab00eb506dbe

SHA256
8401ce8fd8e8c153aceac614f83b7336de18a288ebcb9767af7d998ca5373a09

SHA512
323f3c6fbb2289a14243e951464994cfdf8c5aac837a3439e2d20568d1979dc2f2f10200ad217bfeb0c42332242539ecc64414dc8db183653d321eb8a2a5b05c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17968d2b0f0b297d2f737f4ce3257d9f

SHA1
5b1668e0c6f2b612daef8649f2a2dbdc799871ae

SHA256
958c629a7d15fc3577a76eae61171be4361c2242bf329c2323ab90004d3caa13

SHA512
108099c71e7df0498ad67318d1c7de6b2a067eb80f2983ea08e0d4cb260ed4f24b602a139ffd14b7ef6aca46b27372ae4887ae321fb537b0496727985f6c0038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88d19f351cada580b388857194d629b7

SHA1
1670766eaee71ccc5328145bed5b70253bfca02d

SHA256
7e4a0f44a98bfb14b1fd589be2208c5f790a3483785cb25ca90d36a18201d649

SHA512
ea7f05577a55b7da06f8fe7dcaab8dc54a6b36e975d0132ffd71570eb36fe04eb14785acfdab78f4d7fcf2c11589e9a69866587fa3c216ce8fe611adb9f1fc51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0a3e91b72b2948c3108ad7bca7219d0

SHA1
3cb1e6bd617eb46bc8aeda9ab810143906d93910

SHA256
a246b03a54d916934143258085ef5f6a8f84f41ce03f8e8b1ec26517530c1e6d

SHA512
ffaff513a32f5706f045ce6e74d1d86bb082ae99b854d35054582dfe28a7dbe4672dc738f01aa1f5084f18b6a3d6c8948a00b49d7d447224cf7cea9817b11f95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad6d025e35f08bb855c78d7793c1aa46

SHA1
2fe0ecb8b3c5f3430ca2a70d8351669d47f8f0db

SHA256
fd5e824c3ed97e7c88c3416a392819c192633ae90ccf5575b558c5d22f7b61ca

SHA512
7589f9f65a72b8b1687b98210c5d13ed54779a9c46803244f532db13cb69055769784dd801dc91e75f77d1b5c6f802046e22699216878ac49d186b0ea96d4748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ee04daee0dead9ec34d7a080a11b0b4

SHA1
3bc7ae7a205c13d8ff4f3ece90d72ca36fec10f7

SHA256
2fca431670484fec458603ce38928bb6489ee8867b96e2d733e2dbbe62e2da97

SHA512
c5af5bee17250b62b027e088bae2d5c140d1b22e82f36609288cc59ccf8bab8c238cc180973c3951d7c87ef7aaf8275310fadae68f9bd4dc7127922d1af9bbdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0de4e7c316bc7bb39fdeb4f2c8aa412

SHA1
be055da14dd4afa8efb47439082fdbf4290c550e

SHA256
0968f072dd933bf69de12ab6eeae849c563d23a77d33986209100d1353ee8db3

SHA512
4eb721ba37da2983816f878cd2fa6163f797c23d3bd0560eab670841d9c8b46499ff42a17a8395c10314eae7a4335548f504799165089d5efd1ba5b0f5febdbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6d012df0836dda5a4f2f326f078fb24

SHA1
148e42414d1266246fd32a2b3c3b83c8a2609ae7

SHA256
e1209679e4b9a2b8615ba43c167ead2baf4d1bfb57f9986d5b9d551ebf7eaabd

SHA512
76e3a465dc348f55732ec24aca0ce3d72e92ff31a65b54e3a407d7ac7b38f9fd1d2f6c9e92cbd50862224861e31673eca1e05bab94f778b4ed82a2da6399b153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a6c2d7f623d5b1e3192782f04e77683

SHA1
ba052be0f959306ac810b924ecc6009d7e116139

SHA256
4e22fe5a89e5ea67bee0bf681b80fd2100f74ef18ef66a37bc928b9418aa18bb

SHA512
531b180271f89d8c367cf68cd53eea2cb3f095615d9b978a161d9288e697fe5614794e9be5d26f3a0b10ed3f5374ef1c64dfe30b5bc89b99c0e48458456dc17b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7532714e1b9f122cc901163079b3f762

SHA1
f28d1d82283b4d14ba8eba46e3c9fc278a0a85ed

SHA256
01b111612e0da60bf4a9732b77af2c5c0b20ce39ba976783641ed05089cd1588

SHA512
612e514dd3d41af8043a15d8dface4c6f60ac7afb4ad9ee6eec4c4a24bc900d79847b1f72a8e9713297b75c6cebdb2836b63c3b49b4afc3dbe2c40c997a1c21b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76d813d89f01c640d2eb9433b20a1675

SHA1
6762b2516ee3a293e3dbed7779325dd386173cd0

SHA256
0ce2fa6a7653bbda9e9b7e85e9347661e5f9c96d761b10c3bbc622bab4b37348

SHA512
1fb2f426ce54fc343a2a5c1aeef3d743289de51f7df013b4ee0a1dd22377ca270d0f8c97177b59e79dddbe047159bb4a713825fd817d34ff3558809c2465da6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59d32ad3f98c37bf87bbc81044d572ff

SHA1
b5280d759e08fe7e79bb1dd6539b931bfea72c0c

SHA256
3a8ba273c020a55609214c03555ee7a0628383eadc8c4d279d51559980e1f959

SHA512
1183871ccd2ff16e6ab20ffd3d700575732d47890c48f278b891663668fd423f30535a41832a30c85a4f1b194fa43f4e13f9bc99474411a59aeccd7558f34eb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a549c5456953d17153ed80470c3823f

SHA1
b752aec2342f93bc37e304223c349162924279e5

SHA256
8c3a70f3cf7785ab424e074acc2166c5a9ce36dba43ca1247b4a297a07ebe012

SHA512
0d735c2a52aa33db11d8086c70cab0a677cc04f9b073b7c90977ccad589b7fbe8e58dbcd1cc99271eb5936a1281ef90fd1e3c5c06a4365017d2df570745e6429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fe1994018dad32be0ca0c0e475f9849

SHA1
7f95887913fde62e0faed29edfe07a7371167c2d

SHA256
4deddbd3c276017d00163483d1e16d3df36bf5f1824b1f748ff7cae7dc58c27e

SHA512
034cb9c966491e46742b3b2f7568e584363f7cf0419a13dffe8b0b04c0d6bb60c6015e50868ac25ed9cdef5632079f813120269df8ca5510bd70abe4648b97b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70720a0e4ef7153bb424da34b84207bf

SHA1
8654f8c376ebfd36854946199269cfa65dc33a4b

SHA256
bbc8e24606dab1642453e7a61433efd526ab71906a56a836d451dd958ffee1ca

SHA512
c0408564ec705c00ac23abc4c64b585a728559e474efd726689a6799b7f722ff1227935df6343a5492d19b436e77b281cd3f945c1adc67489e6c4f8a10bc6217

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27b3abc8e6f29259bd0998ac681fc700

SHA1
e6920e0af6846266318883120a09bce7ab856d76

SHA256
4a071afaca36bf77b9873d771ade946d021a7d89bcd3f3ad180a77da31d484f7

SHA512
3b72f284a35c798b6877baef93a733843b0e86c01b12d9f4e3e9896873dc911eb95237aae73f1785676253b002cb0196bceb3a52cac5f8e3fd129a8d99ff9774

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab259D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar261D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit