e8d1caba7f8c4d2bf974b08cec13f09e66c7fe322f77a5631abbae0b013fa39c

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

251f55ebd99c456129eb3dcdf961a0cd.html
Size

57KB
MD5

251f55ebd99c456129eb3dcdf961a0cd
SHA1

22ebe083ef9e64ed2146aba02d878f7462771b60
SHA256

e8d1caba7f8c4d2bf974b08cec13f09e66c7fe322f77a5631abbae0b013fa39c
SHA512

9fb99ee4a206a9897c02f130f1280aa76fbb52a126ae6ae25e4b79497de438a7d6579215dd1e2d55c9fdedaff5d1b33c62ea5adbdbdb821a44d714794d3bb1aa
SSDEEP

1536:gQZBCCOd20IxCtmFjfffkGf9fGfoftfifZfAfEf8f0fRfSfBfJfxfDfwf8fvfafz:gk2g0IxRHH1+Q1KBYMUM56Jh5rY0XCeq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1092d0559a39da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000004707984904441862a7914c791648e5c5fb3291aec804cc1ec38ad7d08a7688fe000000000e8000000002000020000000d4314c2f23d9cd9d0cc3426f8fe79b8bda3a577e7ecf49c35752b4f034be8e8b20000000882e5b11b71b685f99c74f16ad7134dda0ffb20c9e9cb7baa69316ccd75b4baa4000000015315e749be7192523e20ca80aca095b19964a486973d93147b9246f05072e1fbd81794719d2ddce9ee7d73b3fdd96d0b429913a31650a1351e5f62fa987401e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000931d9e6ecfd67acd60b98fcd4ae0b6d62ae8a8b73e4a20a1986a5c81777fe229000000000e8000000002000020000000e0ba57da191d9ae720543a9c5cbaca9a50ab0324ef3a6e19af2c2139cc5bb09b9000000038ff5527a68b232be164d2375bc614b35bc03524c768984fd686d8539edac8b9dedd72c1387683b95c724b87c01aa2fad30d072dcfd7e646d660d56b68e9cc091c944f76da46194a1c86a95e8f2bf4e9321691e39d416468e2e3b17fd18a1bfbb707e967e3d52ab4e5205ec85cc75045b86cc5517c9fa07d48eb2bd0de2787cc14019191804ec525ca2d65e61990e41f40000000446b195af34b9d57f3edaf79df499df6a05f8b2b4b42068d962cadf1714a774632f0fb704370bb5230a73713a2bc2b9b71d85c44c90baa5d8a21785d0fe67c32	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{617AC681-A58D-11EE-9BD1-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409935586"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2428	1700	iexplore.exe	28
PID 1700 wrote to memory of 2428	1700	iexplore.exe	28
PID 1700 wrote to memory of 2428	1700	iexplore.exe	28
PID 1700 wrote to memory of 2428	1700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\251f55ebd99c456129eb3dcdf961a0cd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4e86ccd6d3b41da1f2aed2d3d870f60

SHA1
b403970cea5aab2b3f636b9a51d7ec0919c5eede

SHA256
f07a993ebb0b8eaf681ba8107a619adb7b68aedc631fa3b72e9446b2a4334eea

SHA512
3084af44b0fb5d4e4c2972093130165c084af9be25734dd8ea948a0b061f9e29ac309eafa67a77e612687961c518e104c85681fa600ad1d3c4e0235b3365efc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d596b5e4ddd6944f84850d13151d13b2

SHA1
94f38735c6b8dd7d97bb31cc21cf8e1338e08153

SHA256
8b215cd0d746f8f7418c830f303ded0cf9049dc4459c26870b4c3215c26f8894

SHA512
0def8c49c632ac2dcb67153690beb38ea4ee5e6529605ca8793690338adb17e2b9d02d30c664f8338d6b86af8af23442a3ce661eea604a8f2a5ce58266bdeb8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9aee0eefd1d838194039e2686673f081

SHA1
bb01c2e19f836c0bdd671cd49ec0cbce7e4faab9

SHA256
5580fcd2f79a2ff68551fbb65007be968ea5ecfc5cbdd4fa0b15423ac1a6a9f0

SHA512
f937999f587df67ac67378661663ca2594866c672ac9df5e10f5ef7c4d89f4c4a168eee7637e4f76211bd5ea68dfda2e2e699818ee9d31e0bce06445f5ba273e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dae07169349a57317cacab7e51d51f4a

SHA1
94012eecfdfbb2a2343f4b0a6bbaf3313c7818dc

SHA256
6e1af3caeb2b7480c3d707d4fc7a61311036c44d5d0a6d957930bf1287ab126c

SHA512
99c075b2ffd748024b82b9ceba408619e5ab84c050285053f8bb42c4bfe8a0d61e0a2ddb106384043e6dfbdc2ce2faeb9bfd187885fa6e20cb710480f7793357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aabf2d9cd0e03d119a85cad7a50d022f

SHA1
cb14a946d2338bf977afcccbbc1582025c02c646

SHA256
8a6b332a9a7cf6d405c4a09c092476d4af531bd8736a4563ce8317a57c0b33bc

SHA512
c7dba2b4ca6fbe61a878128b865eae01a75c1f13caada671b24d5dbd87c8d10373f025e7fa0a5ed86cc4bfd933b5cd3d478b6657e31fe98162a3525b22c985c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e31b28314865d3281b8c6ad5e929b837

SHA1
251b071737630315daf51616d4597f4d4f02d191

SHA256
da1a5df4ebeee7f8d9cc6d8e7af344bd34b9d12b56e6830f903c1081386a0d49

SHA512
87b6eb1e7f34301e18e83945eed81960a4e0701d5d22234abb93b09e23b19482f6ae485a89dae75d16c68633a2bb2e3b51a4b759f210d01338ced73400b474e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
036d8fceccd3940420291c75cdb30ed4

SHA1
30721d594a9aca12682d2383289156b17c83f475

SHA256
55b46e9644a1cdb38df0bbc57ed1918b379609bc904579488cc82fa51603d901

SHA512
bb8f41923a6b8bd52b423c8a2b733a96fed3fea049a90cf3ab5001ce16b315203488c12befcda03296a952f11eb00c0feaa52dc1d420d3beb569a2e6b9c6be78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b68402f9be59d7395ee75d0e493c557e

SHA1
a7099578094bb66c0ce9211d5bfdf263e115491e

SHA256
d930a50a7b69d33e58182ddf6e20195e64785532cef3f0bd18a77009e8e45781

SHA512
706890ee3447fdc166965a51be127e0cce1ae0f3159ecc9ad20879939e13d0d543c5026823530c0814697d3e311b2c2bd08d1b8e05fe8e31e5ec6809e3adb6d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18a862e49db6096e76b12c0755aca5ac

SHA1
a30c7de61143c5391ae0177993788aee389125e4

SHA256
93c0688b1ac10b1970e2a76c2f73e5755975ce846562e5beef6a0e742d0e933f

SHA512
dc935bffed9460b3dca82e8611e62f841f9331f3036a3a4e5e6a67a2e79986746e1d64be30ad25f7b133ed2ec23bb0aa93262352d05b892994f7d03d532bd23b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9ca3a474464aa497974e94fa9bf41e3

SHA1
20b8dc1ace48f6ac70f08300d833c5777d0ac4a6

SHA256
3efb517880491148200900b647b2774d5f029da105968a9a77347cf741f27859

SHA512
c5db8bcab1172bb59f7a0e7e6ce1f31d40b8181f8492066f356863fcef10318639de7344849ee99df089e68d2f3e5799a1495a6ac547b93bd1287ee634598425

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a9793c3e229a9013d9bb0e560cae526

SHA1
4eb15a980f2af40270f2f87bcbeb4f4826853888

SHA256
a6262e0e26eca41add00a377c469217be6e1eda87991e9f3f548926aaaa6d97d

SHA512
7cea303138995866982f621cacdcd4c52afc6d4cc76d84638550f8dcf1f278f68577444b8d6d00eb7a2914b3f604ef57ae2d7bd5ffcde37e1c937637e042d251

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80f9ea284746fcd17b0b6fe77546fbeb

SHA1
a29176b85c940abc2a646dd719c94e3b14f31317

SHA256
055376724b089be429ff5ce10760cfa23fbe15c56a8738f3ff6fa87bed5db7c4

SHA512
e496d87e3a09f057b753195df84613fccf2ac0454ab4151435db3d02fc1b9efb3fedc7bd7b73a9dc0b316d8f092156e7edc24843adeaf66bdc6c6f657be73155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d789a7ce479ba76eee745c759c876514

SHA1
b1f6445e5cddc9eb32ae26a453da42e5fd028f8b

SHA256
d0345c2159619701ddcda50f85c999990ba803bcb53982b10e202b6dd9b95108

SHA512
d3c3926e7afe5bd58b8f8df25d8f167a2fcbb23620f02ae1c3327827a2cee1c1a392e7d43e3e12f36dc584c88d9236891df37438d5f458a4b2b4a3cccb3a5e68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
102840d99e51b90a803bba1f018adc58

SHA1
b4a27a48533487f6fe6ca492072dc8481a67d52b

SHA256
56db77222ef13351935d3ac80e502ecd4af6175be5c17eae5eae032f63fde83a

SHA512
3be18194f9e9ff75edc4adfe47d450f323de522084a2d74576ab2c08db51737c901a0b7356f080864d7c1545e77529c8bf34ff71a4bc2d89ad6596fa69c1504f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0f0418b2cff2f70692df4daab9a0747

SHA1
2723b379b323cbcf798d8558cc0208a24c6fe627

SHA256
2aa076fcca336cd2a01d189dee84cdef630e3d52a672b6a93a2354840028607d

SHA512
faf6acb4ce35e1e238c8c6cc049f18ff6c5f4c7adea263684518e8e65167d53e09e1b366e618cef8b4caecc068ff3e805589b10bc6139aed73639d2e6ee0be89

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB241.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB263.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit