e9070e219f733fef47a3369b49d88b82163f676d940b6e5a62933287043c81be

Analysis

max time kernel
120s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

176d235f8c31c44d68315b2df20d4edd.html
Size

53KB
MD5

176d235f8c31c44d68315b2df20d4edd
SHA1

4f3c6ac7f42830448b4daa26d20ba3fa31b0fe90
SHA256

e9070e219f733fef47a3369b49d88b82163f676d940b6e5a62933287043c81be
SHA512

90a45fed9cad79ad10c48957205faa0082a4576bb2b65e297a9aad774b98119bf11f158fe3d2803d53975b1e3d2a1d00205aa477dc7860352375a155827bd0ae
SSDEEP

1536:CkgUiIakTqGivi+PyUNrunlY6o63Nj+q5VyvR0w2AzTICbbtob8/t9M/dNwIUED9:CkgUiIakTqGivi+PyUNrunlY6o63Nj+i

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000078be1ca0f1552543ac69b80f49c01a896fce566c7768f248b211b67deb7de2f7000000000e8000000002000020000000bcce169e0cba65cc82c3dc9af8c98283eddb0f74d53c1fce0ab62060174a230b200000005fba567e07180d61ce620d775f7e46efeff6644f20a050953d334d41efbc41d140000000751e6ad4e571dc5109622a0002644c58784472b521cbcd610c7bd6dcb3e1572f8be314037537a6b9c8bd8157f7fecf1f2b467b890a9e6604e9067b0129215899	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e1539ba850af47404d5af10bbdde4e7c04a787c5293a639cc73b8ddd84af02a1000000000e800000000200002000000005b6dbd2c1430d3047fbdbb2c5d2f0feb326a4a97be8d16ad36e6915efd5db7e900000003b3cd235f942bfa9e33b8a9744c745b76d08bf91b3892a854307059d8a8a87227367f9b23b785ad3356bfb94f4fc9803a5c9ca3a956b12514ee9cc803c767eddaee12e3cbebf7509072e2b39963850ec73c77f8f214d2b1b10e7682c1eb168396f084bdf2cd0df9ab84430add3e5df8305284d8d85ee4dda3bbf0df7a2356e937493ae2bdd9ab7e008c4f2b34f6604e240000000708ca34b852b824998311a9ee483166ddc83f1a1691031c6ce7aa086c099e937a470dc00b28d474ff4c312a4c67714163b3f7a9fa5be5daa2d4131b86f48064b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F657911-A388-11EE-A2F4-4AE60EE50717} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100caa4f9537da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409713509"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2740	2884	iexplore.exe	28
PID 2884 wrote to memory of 2740	2884	iexplore.exe	28
PID 2884 wrote to memory of 2740	2884	iexplore.exe	28
PID 2884 wrote to memory of 2740	2884	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\176d235f8c31c44d68315b2df20d4edd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a755a41c38230ca75e8a40a708b201b

SHA1
0baf251b7999d868203a96905dbe7f1865da4e3f

SHA256
8f2e76600dd6ec45cd05fa8840d6f2c78ce79ceb7415108de202a308ab16f480

SHA512
881bb661873cd046d3fcbc5d79235eff7209c8200833d18ff55b86231eca2db678b6207ffd0452d556305ba75129fcfb4abe8cafd5e1345f1cb5b16ae10fa4c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1cf6631b6e2ebb30f85d1eda4895d68

SHA1
1d701f934bd7cdd73038b4d511c1fdde685856ce

SHA256
d02723e9624f348a6832e60d80f750f52d897a0ba530a3dc7dc70a98357f2300

SHA512
06159014ee1f66211470ce4d161c74ce17545787e97bcef69e2278c9df1ea47ccb4c64a62ac3c6145b2e7732ea64b0619add040fd2ab1bbe42da9df0ec6897bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd2da96de0b80a1d4cda85d32f320baa

SHA1
6470b4e38ec274e1fba0f3bfdffb17bf48076fb4

SHA256
fe312dabdc6e75a74bc0fd8d27df70dbb0cd3145d206b344c3001f27dea34ba9

SHA512
c762e006ff7428a329fab0eec7e063de488721840bacbd85ef99bfb6ab4731120b6684f8d8bbb0c3219ebb2c63ab4592278a2fde67372824288f3c19d2b6e889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfef7d8390753a1d42cc7144b5801b78

SHA1
da538f7f1ea6792e43f5e551a077d218c5b7409c

SHA256
a80ab37857a275465c20cb2beff4f3b3d6df1c0b43368a055449b1201c8c6904

SHA512
ccafc679281573b3b12deceea9e178d633749901c9f8cf88988ef61d27ab0015ea488f36608c641d00ef69f30c20cbf99ab978a14689fb51debe9ed1a2f3889a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe4b21c28d216a0f3d0fb7ee7569217d

SHA1
885db3e58f7338173ea1540814b2aeb19d0a5191

SHA256
bca44baf9a971e68a35a8adb6ee7f40e376e8340c2638b886435036a5a7a8055

SHA512
114c319e4fd76b4d43a71c972de9648907a50a5bb87416362a50ce89fdec1ff38f2d35a9fdd4b7b5702d3154342c0e30494acba311ce891fe2ea7d94d11c6a25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43bb9a68fa86b664a460893d4e688292

SHA1
c6d83b0dcb0ffe915b634afd826479a98f712c5a

SHA256
8966f094cf4c6a3f31362b687eeb4751cc95a6e0681d7b56e8d464e064cb7382

SHA512
29d1fdc9a4c48f1ddac31054ee7d513c9b30df9745b3bdaa37bf1be73162ade845829b07b9c24cacca54eea4cc382f325e7ac299f5a76cf2e5aa981b76140410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdbf67b5b83d9294be994d909d1b7ed4

SHA1
264c29d01a9280d2fdb7a17e8b6871c08fcccf57

SHA256
8c6920d7d3f5c69e460bfa99853f1570fcbf292d308e16c6287d106a70a1b89d

SHA512
ad954a14e763c9aea505ba83f7b93a971b3499bda2df2807a6111d219bfa77136f4bf15c32a653597ba33744c1af2bad355dc8cc7be2e36a2a8dd83cd8153b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20f156ec3f32d4b80fac1891aa7d1251

SHA1
6be5ab3979cf1e383abed36be941bcd9bca763ea

SHA256
df2c97cad94fa745767f043cb70f1e6f6e9c28557dc19c7d4344c45bf99a57b0

SHA512
76168b8a1acbfc6a3600aee5a48ab587064b8bf807a8eea88af45d3f0c30593cba6c1fa4397a980822bd5edb444837741f255a454642030eb612e47df0fbe60e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
803ed47d215c3a030f602f71240a2141

SHA1
0be638d3a796c0c53da93db1a88fb98387e4a204

SHA256
dd74e12b89668fcef100f0504b10efa25d1febc0848cbdc882b42af93c0f7796

SHA512
52e5a7481b0c573ac1d67b0c11ee8d82dd761408d771aa97a79a370c6e8cd9074b6938dce3feb6fbab50c7506b42fbee25cbdac635ace101b32243a3caa7aeee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e939e7dfe155ada4add4b702d3c3ff9

SHA1
213090513c75541b5d8399c2dc633efab13ee408

SHA256
203d97d929fe1685984eaa5f418c2579ec35fc5137280be6c393dbc7c2758247

SHA512
90eeeaf6c31b1b0c9b8a0012949c775e08aa46a3d062877842f1e8e946b58751e866ae05c108e3d51c50bfa7d81a5b3fe9c836e3c004f4a5edcfdd04b5250cd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
083bd5035ac0c6352386af92461c347b

SHA1
4635f756daa16b1ae95e554cf7538910d460d34d

SHA256
84de678bbb0636970938fe26eb0e8ba75bb2845d76066093823880b2e2524ae0

SHA512
4e3a72cce0ef6361b8a3d7ce3aab709eb5bf5271f0444d888c058ba424e8b0ccc68ff159eb6b77b9b267654672de8448140db352b8823b029b9fafb533ab5e08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
675892360242954d106fb0140dd9ddd9

SHA1
fc9704fce07faea75d54dc3e0ff2063e8c6d6581

SHA256
8046ec6582a111989fbee99ca4861839e7d542aba33f5bc9e28b493e3c53af5f

SHA512
ab4049e0c1f42f4853be0bcb4bba3ea995a6b0f7161816f81e77318f1d660693bc5c335a5d5cc6359d73a7f823be64633d5843352c6f104676dec7d12b05d12b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f82b0e039aa832895c1f4d92b4921a6d

SHA1
c7261c5efc1ce799aefff6d51a8e1306abca2bd2

SHA256
e4cddab265b251d1d18b3686e15e4b2519f405036ebf05d3eb05af96f947fd5a

SHA512
b52230ec310a9c78e52ce49f33c60d7b8034585f1ad33ef9163124e9731a8df0b1746b97adbe2ea920e22371c48417d0085fef85d967305faaa37cc31d45547d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6840b0b8790c73e6b588f34ebb0031f

SHA1
4c26c17449ebb88488bd4138e8218743ccd1384e

SHA256
738ceb9100af52597dd34b1ee4f9d2c1ac1e713771149f27c3e11c431e004d19

SHA512
b20373ed7121d6498194a764b3377ea7f2cb10dca6590ef4f4961322e49ff1fa63b9a7ac10e8ad47bed8d67bbdac31d269632bed2b5edd972ee16a44202903c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\print[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab78C8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7E97.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit