e5b33606e9601a1bd5dbc851e8b74f838edd1c480497ad38b60e4482de885a8a

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

229886a0c4acfcd05685a3313d6b682a.html
Size

53KB
MD5

229886a0c4acfcd05685a3313d6b682a
SHA1

b9a90285e18752934889d831a5c5ff1574e876bb
SHA256

e5b33606e9601a1bd5dbc851e8b74f838edd1c480497ad38b60e4482de885a8a
SHA512

a0cbff02254cab3b238e115d4b74aee80131fac4710b9123fb40732b0ea6ed7c1d5917de1a85e13beb7788ae5614b63d28bf7a8a79ddaef1bd0c48445d41c0db
SSDEEP

1536:CkgUiIakTqGivi+PyUorunlY863Nj+q5VyvR0w2AzTICbblo5/t9M/dNwIUEDmDn:CkgUiIakTqGivi+PyUorunlY863Nj+qV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000007b45288809fb7d41d835eaf844e22dfe276e14f90bc82d476fbf29eed3ebca50000000000e8000000002000020000000ae60bb2a4b38d2b0e01455185fdfa77584e234055177e5c0fc0beac2add975e920000000dd3c08eb9aa5d4d4dc379d7315ca6e4f8b5c9f899ddea9ade3851d2dce1382b040000000b45ebcd68dafe6749c17e0b0be448749a608a210d9e1bde83ecb17ff3e565534b825844c6e6414111011da58bfa8dfa18cf5269c17ecdaa56b400bc94c10b62a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5927B311-A576-11EE-88F9-76B33C18F4CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ba2cdb513360993c76019773b838db99113cbe13dc7910cd233d8fba593a7db8000000000e8000000002000020000000c2284c614547e32226468840d128fb8bedf7ff821bce25fbc77760a59376840c90000000a91cf56bb03288da3dcbe09c0f61df89baf5bfcd8e9d41dea933a92b9a9e629b81f1a3c6dfb2c81a7695b78907014e824ced0b578c13a38482140be61ffbd4f16c2eb3c2806f9f8c35b6aa4870740e8dbaa8ca6bc7854676d4cf817fff0490a5bb0c994fbd6706f6dfb234014f31c7d5e92fe20983dc8446cbcba243b976baebfa38a4d75f0808cc0e06331b02844cff400000005e6fe4e11909c19265adce58e58e3e55372d0f0dc0f8e517354fdcf2b444dbb8c974cecaabcddd693b19c71e4dcfeb00278ca9d2b5caed9299b9c9b12e7a2f5d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a055814a8339da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409925717"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE
1888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1888	2204	iexplore.exe	28
PID 2204 wrote to memory of 1888	2204	iexplore.exe	28
PID 2204 wrote to memory of 1888	2204	iexplore.exe	28
PID 2204 wrote to memory of 1888	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\229886a0c4acfcd05685a3313d6b682a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
095630c93a2a0743bbd84ecf59f00530

SHA1
f8ae31c8c61671845f939a30f2fb38ffb17d3c82

SHA256
7f1aaa3c7bfbc643e70b4c0ba8755240c3743e6bba37efb51756e4f9742e7930

SHA512
ab30139e742174ee8954fbb24950d6a2be00f83b0ed95d7eb9d23503bd3814fbad06bb4c14f270eaaf4bdff7bb2ff9f22557d3cb533e132b4eca2350b0a2933d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76b41ffdc868b076b955061dc734a972

SHA1
9c5e494f2c636cfa87eb1389cfc3e71505edbf0b

SHA256
9b15a1020ab73cbba686208a302533eb22cc47390fee1f181630e8f24d8c09be

SHA512
5d07479d1c9df54759de616311c5dab61aa3f1d28b7d35043f2992c918645d940aa409d11b3a9d493d99f7efc92827a61ecf26019fdcc892854ad50fcd878ad0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ce8f652a97bc22c1fef718e36954e63

SHA1
d67b466c1358bf8f5a3152c5a58beb0feaee692a

SHA256
fc329646226f7d591c448b21f628a7818ad6a76f87b140b3ddc03e0d9e15f0c1

SHA512
b164892e7036def7e9a7c103a74d5e5078e0135f75dc9890a640d58e9e11b037a8bdc181d6005d66a1ee32f63152b49405732f5ef702e7990daba15f3f87d21c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4512b463c08921cd350529596d5d255c

SHA1
59a80485459a25a03aed9ffad034bbb122ad5b11

SHA256
cfae857fef8a4ca26dca7cf97eb1231c2b43a38c7b7723f9aaf208a1631566ba

SHA512
91b5ddc6371314e9d91f33088baa2710134b57b00cc5453247f2496406c13c22e7a4d69830bd19c3d875d598573c460fa362d587c99a445b1a89b6a8fe93d978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09e105142759bff9c115b64af0bf1633

SHA1
39a950fc4ee8465fe637ed73450e7957cf7cca5c

SHA256
56fca8783266a6f639ca2d39d316794dced22bfdc155f2a9d51705980e5d2af6

SHA512
5e96df39a4381b5524ced693e49a34a9f2879f49ce0dfa073da9a1f0a14e2e1361843e43a66e49fd7fc2d78ffba123a71920f7b7456786bbc35a8944ce6d195a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53e741cc4de21c3cb8de24c8b79ca218

SHA1
6326197ca3fe5323a0cb8821da3ded224d628b1a

SHA256
e2aa3f17d8dc7e4ac7d1cd75db8b6225c475f975ee41b86ae4ec68271e8a0ba5

SHA512
550d68e5993faef755e0de9c3e99807467c0036e67dba48eade0f0d1182331ea4f098415acb57bcee3253908881761ff6a05cb9ecea05f13b4d235fe9cb6a33b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c98c1f2c6f5d63c1e5aa488c112b8abb

SHA1
635048e2de7771b51e6ad6773b6f830db8fd2afa

SHA256
9b8ea3629a16221d919fd3237fd4607e7e32baadb8647bdfeb21c37dcaa8af3e

SHA512
9807bbda70b25bf2b9ea5f96fc8bcf5a625cabb43b9eb6a0056e6ecdbb4346db7992e0fcb633656af0f02952decaf23e43bc3d34e2c209a27a2edd374e67ceaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06e9ced7234ce81f94faff508a862189

SHA1
c845f4d59c022cade872e787910f39baf56763a3

SHA256
db62ff49130a2eacbf15cf3f6b8b12e634ca405a2acfd59e2d7527755cf3ab9b

SHA512
667bd4657e827cb3f1e60af6191b811977a841cf8039f645427171ac005e911690a1a8d59ece028d92698b906a03a22476ce29a4d148871782d596ebf35ad95c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c03d94150c0b5111eaa97f6f690c6b5

SHA1
47951013db521b5a194103ad402501f6fbdb4a26

SHA256
21238c633b88d410b7fb53e8339cff9706f5c5c83bbf57dd5f9a23eae81f5b24

SHA512
2d26346fa5f91c6fec7ec33ff2751d2ce088d0f72e84b1f690d6f70023908e56b9805409ca31a005f39f1a1f874a9289281a927dc334065059df5e5224e17859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d8bc51b3df7a37a9d451948c91b2561

SHA1
d7b07d26db8a381568da705fba962f047232ceed

SHA256
976a2224c24cdfb6c04fa0ec71ec53fdea247ac024a9ca96ca1360b189243a79

SHA512
48e7b330ff1af6d6c4481e9c5f2573c6efde95cf44a2ab61b18602c47a8e97787c2c295486d73caf5af2357af3f7715e077fd82e7e51450af59cd65955e57264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2060fdea17bc56205809d29c57696c1

SHA1
b0d2655f1c92a1e16203b0e08e38affe3756a338

SHA256
2b396e92c3d1a9edd39a20985c08fd1900049460abfbc445d8a4c5bae5214af5

SHA512
68bafc0cfaf787036151457772e2f50cc7f1bfb3ce1f4026a291b06613e35817c408116fa8f10d40edfef1ca8202e2670d839e384d01994cb4805dff5b40d971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11df53270e0abced68c8f0870194c73f

SHA1
be3be470f6f0782a27c85072abe97792f6a1eedc

SHA256
9604c4191a73b84978d6f809eba22c618c9fd8515d7ee25c93c7e3affdd7976e

SHA512
e47797bdc633125682465b4091829eb38365ee89ab485e63dbd3dac6021ae275e2ab67154a4d215759168064313d7deb4ef91c84ef0cdc130f14c456fe25815b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\glossar-js[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7CC1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7D71.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit