e4ebe2fd312f71c165fa6b1c9159d0182edb9674c9d2dace78cd10d6d06bef52

Analysis

max time kernel
121s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

177d605a0718215ed238396200c53ebd.html
Size

42KB
MD5

177d605a0718215ed238396200c53ebd
SHA1

ff64d35c35391778bfa4e5fa8ed6038b0263fcce
SHA256

e4ebe2fd312f71c165fa6b1c9159d0182edb9674c9d2dace78cd10d6d06bef52
SHA512

c7b7d94cd3ca8f37f6265a07bf873265de600fa441bc50938bd927a97fec8950abf0af9761d9634bf0ddf1f7b57aab354382feca6036756213a4f9fb969d3e45
SSDEEP

768:Zcd9QZBC7mOdMsCpC5I9nC4/PqQqCvqwBwow2C8kPd:gQZBCCOdO0IxCEPqQBqwBwowr8kPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C4999C1-A513-11EE-BE0E-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000005c316a744be75f85e7357c209141c1dd8fe368bfcf6987553304911a15f67a5000000000e8000000002000020000000a8ddad7be2a8926534361bfd915c5b91a4b353c5263108df34eeac50332e4a9f2000000036a2eef640e94cd910a393bf5ee76476bc005eecc7fe2d681420386cde92c37740000000da9540b714d9e4cc1f42fb1d5739352bdf22dd009d2d55ec74f5ac918dc72a91b2341c16ee11b6c9b6d12ee947f39b27d591f8cfbb8e0a86a117e780affacfe5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 601c64762039da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000004d28148969c478a4ff461b941fe9d1acaa356255de9aedceb7a758d68da968e6000000000e8000000002000020000000673261648900fb0d79bcbd6a8c5340068ebd10b8c28c3ed86b7c791a8e661a0690000000981c3dffbcb5241264b149870147ba993e2c19aa1b7d9eaeadfb72aabb5503fad07e57f7226638d2b0be70feffa6d0776fd7c12239a654363da5c4df199c9dc7eca41ebafcce2972c202e9f170a3d2b3a3709c9cb2583ef90d52c1bb3a7ffaeff59c74d41a5ccfed01ee0b4f38c176d0086afff3580498186444b9fc2b579a49e92efdbfe598311d305c430890c0867b40000000a7e1b246d259d063473c2a62c2e263c970111a45071b673d3874cb13f174313e3bea4f599facf9b02c365c99bd44bddef372a019146da13b6d1306836fd9c28f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409883243"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2932	2140	iexplore.exe	28
PID 2140 wrote to memory of 2932	2140	iexplore.exe	28
PID 2140 wrote to memory of 2932	2140	iexplore.exe	28
PID 2140 wrote to memory of 2932	2140	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\177d605a0718215ed238396200c53ebd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b77d49185297505721911bb82395b047

SHA1
72ddbd084bdf7325be2cff4beaa4ccaa1d4b7860

SHA256
28724b91295a74fbbd00bbd58b1ae586167810220be49d0e7c26b21575be0bc3

SHA512
0c7672483b9458eb105b09834dd526fdd6884646dea1837f45f95b9f5ccd058c128bd16bd98ea6de735a9c299af570619d4f2bdd743d761b39fe6fdd677191f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e04d91fcd83ddcbd8cae86fe7ee7625

SHA1
7e2634c5975d525c0b12887b3e24901e6567d3b6

SHA256
16b491499f1bb527b0593bf6538ba15b887b4243bf11aff71015d45a1924427e

SHA512
ffb8a1d810c2d028d843418e6ecce349d608ed97a0add43ab50f40ec45ef4bcd5d165c6302bd0d8aea11e7584bfd4b90e6bdb128c9e507c1e6d33e525aef9992

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
018b1147cbef5b5e90adb1330c12b9f9

SHA1
f6de06d9a7bc04ce2584c36fdb22a2450e8133bc

SHA256
b8fb6de4e0fe1fcc3b415b8ee1c7aed3fbde3118792882aa04aa03ec89b17547

SHA512
8f899e93a558f18443d2121c6fc3ad31e41fb797c16d300a859f7409a5dd2a463dbed7d894558f3be885486bd52f09ea69658efeecfa75266c247ce193eb3959

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1400666d9c76862ea60f12153fe635d8

SHA1
3e50a9d7a5f211418b05b191008eb8f384e46a5c

SHA256
7b56b9faa0a27faf7f7216493fc508f880b665571f892586239d64ef4f4ca0bb

SHA512
4acb9fb14f51171a342d84579de42f719d312ebf49a68ecec28600f6ddfc50f82d564868b2a45a99586a6f28b895b50eee1ab2ec308e8a5057d5225cbfb7ebb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dff57245e8a40f2be2ca38477f5c040

SHA1
cfd60870706a0f71c54136364efb1c2be3576105

SHA256
18237df01cf1fb5f62a3fecd67fc2617760e5696edec2148641d0aea0d38ca49

SHA512
5aaa86ef4c3542626b1871c510f6c8e0c3f2c249ff12d5cc3ffcc3c13c1311fdc832aa8ea166d80df1611676b52a41a0889a565307fb3dd36fec61043ec9ef1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
127234ef046f531bcfebfeb436616bb8

SHA1
6a3ca9aa96b3821d5cccff31016c759788e798a6

SHA256
5e0a901f27fe11db3e9933147e1c3f72792b86621d158695178b1f5cda28aab1

SHA512
f9201b9158dd49916c830e513694353f0062e4642051e9351e636efbb8008aabca27777dd462b38824b27ffaa7f31e2f6ac64aa578e90ac18e7d6031ca45c63e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ea25f7a889c78e26af56763791c72a8

SHA1
68f6dfa8fa6ded18f935191bcb1d3edd06d04f57

SHA256
f772f5584c57f78cd919123caee62189b39197ff244ede0f5ce4a7c5d9b5bdb1

SHA512
3d1291df9b1bcd2b817728ad480a6608a516bbb6c24c292c502da9fd24b967e05c1568e009a0349c76b1e6d0eb9807a144c0ae40577bb41e6d6bf7b710af5d0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7db84d6601619c4e804cf1884e899168

SHA1
224cdeb5557a87159f707c92c2a9b3dbb8fc7b1f

SHA256
4f113306a0e9170ff839cf3e0e9da996743c40b282de4b98a8318c7eded2840b

SHA512
5c185ce177fb7a0bb689ebd185f99a5318f32f006a9de5472784839a45fa186571b8bb04f6ce25094d4d4f29f65f1f1581a463034cda8f9df784701c981408eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b5c123cff268a9e0307bccdc84c6db3

SHA1
d683ef6e89ca9ae5b4e3576b40778d45e84bef29

SHA256
791e2ad695752e934367ae95b79e802c1205304fdcf74434d62bd1f33a2bf242

SHA512
4ea9473f905bab0538f61b131980418342a062aece4d5389749b0cdde337d6011eda066921cfe3cf05a180f4828ad59886fb6f9731eb1548dfd26d021fd66939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcf7134520f5ad4333b68c8283d7841c

SHA1
baa32798b5d20374c247be78b0ef0b1cab96be28

SHA256
ba1a766a1afa23eb7d0e1f64e6a32ff427729962444b90013fefa2758fee4116

SHA512
3be11f1f0a2c74e6684108c5f7fc41177b42898e9b106805dbd6606665f0c4ffa4e3c7ae969b3242d01225c60ac3c0a9e7ce9603d0b70913cf681b2b4d49af30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2686632203ef8a8769535a38816b7b2e

SHA1
39e9127a3d9089978830a57ae7939dfa2fe87e32

SHA256
636699407f59cb817b96d10c526cb4b00b6044d17ef14f45ef20d80e23e0efa3

SHA512
b6ef97846e71026e4ef17611b5da30d63dadb083ef3a53dbd81ee5086bf413b5575374cd2d75ff6033dc1a2eb30410c82d6eed862c46f62965e5a9bb068f6c60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
374eeb344ebe2ec089780da5c373d298

SHA1
e215f860bcfe4194fd35ea6b4eb9cb6fec3af588

SHA256
0220e47c0be6a36edc0c1084d8d39919527dc36713d3761a4c41ff603f6991f4

SHA512
b5f89d3dbf57de5d06819e2102d0b788363c2e11ff0b2933e95e2ab8ec8bffd932c3af79db3e20395cb64ca6b925b91b827aa2e75ae83c535242538d90951a3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B85.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C24.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit