7415d9003a0490a998da511ef8060e6edde0da19c16aaceff40b6ccc483ecd85

Analysis

max time kernel
142s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

25dc52b4e0ca5ec372b69914fac41238.html
Size

38KB
MD5

25dc52b4e0ca5ec372b69914fac41238
SHA1

e7af078b8083f9fac44df55eabba93f4c80c7be0
SHA256

7415d9003a0490a998da511ef8060e6edde0da19c16aaceff40b6ccc483ecd85
SHA512

d571fdf7f1da95e2787ac3eeef3062dfec365230652a1d755fb6b78fa2ecb5dc6c0a9f2ceb514ecf3c7d6a2201278fcf368d2711f9a20609801d11379b808f80
SSDEEP

768:7EgXR+isToJLtNvpOnM3/1pS58rPE68AjQr9GafZr7501raF:7EgXRd+QxNvpkM3/rafZr750VE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 803a3068a139da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000559610b3ea53116c630361c47ae8698db8d11efe51aec9888da533c36fdef627000000000e8000000002000020000000240430eb912c02710cc06dd8975cdaab10bd120bc4abea7a6cae8490a62208f1200000005fcae1790fdb851bb733057fc91fe1c9c1c607f5b788435e0aa63a467f6f015540000000cabbdc0a5e5e64c2fe7061cd9deaa6f1354d29060e97b5717db4e6801e6460bf50b322407421ff6866d4af3dacc73b151f2a6b2e412ccbedcf3a0a9afadc994e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409938641"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000004fed062348e9792ddbf6bec0133aa86bc41d55267a0c1d445a2a1fc254c41a70000000000e80000000020000200000005df20133cf257ddad64a856feea7b5b60b386785c46c09fe7e0b32f20447df2b90000000e7f335f28771cd0c3b60eafe6778c7be2a3c3fca4bd5bfea8920541b878dcfb1fe195ee6d8df76143157f275a030a391025df382df136a046b1e960af8d6cdb1c6bdb8a7996252ec680d13073ee80dc907860df933702f605f3e0698c9275ef321c21c8b19cae208824bff159b2e23c826a9a5315c88b361ced821246748290ab8c0e4dd82fd6a56fc355f3803d5fee1400000001a37a3f546466b2dad0d46a7ffdf8abea7a0802de6aee6dbdc1a350246a2adc02ee4ee026a6bc537ae2b3e66b9a17a5d6c4a127bce708372ccb1bac245dee181	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D8FE061-A594-11EE-BC40-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1104	iexplore.exe
1104	iexplore.exe
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 2056	1104	iexplore.exe	28
PID 1104 wrote to memory of 2056	1104	iexplore.exe	28
PID 1104 wrote to memory of 2056	1104	iexplore.exe	28
PID 1104 wrote to memory of 2056	1104	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\25dc52b4e0ca5ec372b69914fac41238.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
1822f87284184252dfcb52195adc7844

SHA1
fc7cbdcab503f02d6e2e0e1f52066934ee697f8a

SHA256
3450b41cbad767527e950ca3b19e18e50d849ed424f57fd3b85d7f0def566df5

SHA512
48484cfa3eb2008e946cbe545339d2ccc4799b305651e96e5de670693c3507aa3271960d540ef892c7565461a6dde3310355ae2dc15ccce7b8754d38fd432779

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f87fe85514176d17d077820ddb813bb

SHA1
701e930ff4ccb9b98a3ae0ad4a4f5a2030d4d487

SHA256
486ad3a926311f081275515e7b2516a6c398d62bbf0490a987011f77e8cb293c

SHA512
bfa2a6a587f4265f8d5497a139312d82771d06ad82240b9cd5594c5b8ce2c627dd6cbdd5a0ad05846df378dbbcaf6c7a0650a17d81a4f36e6169c834234e7f25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b923d5075f92ae801f0ce7d79d70755

SHA1
fd9f8b266b97ccbc7d9bf7a8d882dbc1f9ad3f08

SHA256
982dc31064c7f3b3b7e85a41d111b1e899b09f4986af50bbd0b2e46247571bff

SHA512
0df1787d9ecd1601ee33db35569ec54e1843717b14bfbffd5307fcf309a1fb479667af1244f39fb9f181147259402a7fe20872b05367c1f2aecbce429ca3277c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6516cae943787d7bbdc461334297409

SHA1
a8fe3bc471905c498215c4e8cf8461b3043879a2

SHA256
47ae9dfbe41d2dd0456e0cf016fb61f437929b75928a2ff2c36f77e89d26c85e

SHA512
7b58b15b97ab49c7caac4803b3bdd285e2014ef329327af1e4b0e4c3e6b2ef5e12ecd3abd6ceeda787f4df69e8c51807919e0b0a216b4536d036c18b79b466f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8836e46a629ded89ccd5047643f7b50d

SHA1
e6928efd81745740af9265625bca64aa0385470a

SHA256
267239b734064657ecb32a0211397764d7d45a5773dbadb3ca85601d1b0ce0fc

SHA512
0992a9b613c1d136549ffbc009611c83f1e789f6fc7cd250067c11a0d1b25dac334acdf4f895524cf1070721203358f4c6bf94951e77b566032214555154875e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71f1f4a6aa9d5833f9e003ef90f2d64c

SHA1
8255a11eb4de99fe472d482ab1f91d2b97d9e040

SHA256
bde3720c1ab9ac6939ba595bd87add3d063a3589c57f8b2d05928ecfddb91a16

SHA512
906c2a3b54780ef06db3c808bc7a29df99c2884b140572ea9dd066d153acfd6bbdf6b4b641bd9b21696c71d497d4aa6c79674ddd800376a905ddc940e6dd41d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85ab2f873eae35a3652a62394374e041

SHA1
e3539bdaa62d4bcbc0c8239c527c0c4acbb1c714

SHA256
fee0b959a6d8f6b3e9596e499f226e82e16f0abc5e033a74e30ef10876dc3548

SHA512
2a207069c1644616cef8963664dc4a81b5e7385c2b7fdf78986e6db5fc2b2f10ba013b39fb5285ab9779dfdb3ef9d2930e5a4eab8ee10acf4e4284c780a0a9cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a473bb99f76b72c5bb15eaca7a950c47

SHA1
69ebfac2718a29c8e80c4c16c99df49a3b9a6440

SHA256
b0179f79c78f37ce876274a107b36ccf82fb58d2680466c6c82fd152c82c14ab

SHA512
b8abdf6a5894e554ec6e4ed1ecced93631a8fb8387dbb79f4a9c8ca8b905d19f1a21dbcd4bd9b24e83025030475bf17a8a009bf53dd0b6421e01446137d53345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb2488ee166f3af9ceb726a599320136

SHA1
56231d0acfb73c92273dcb3dfd249ff9bd1f86df

SHA256
2d266af30c280d4388997147aeb45572163daa067cf988af878041c5f2954f40

SHA512
906dda3ceda2cac82a9e66339fb1134a64600a21730658a068f71f3b052e6dfb279f093487f7a4bc59e4f60168c657eda1ee764e58294c4ae761321212a353a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a18a5e2b810019f1c366a960331743e

SHA1
3d78d8afe15312dd5086aac32dbb9ef6ee86f05f

SHA256
e3d347341722ffb76f4112195c36dee6b8111e4fcdc15509ace6c5f4b4296284

SHA512
37cc795e3625529ed44ca47695186000f9186f0fa28e6b33f07f3908a55c83a522bd81071eb08a96184615a2dc80a1a710131fcbe189d6fad1eb2d978dbaa478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a3d5cc74d49e9c6d5368f85b6a06606

SHA1
f0b5ca07506cf8936279dd435b6ecbfc2384e817

SHA256
01cc4cd51292174b5e7b27c3c6cbc1e00f1fbd79f0be1554a32acde6b2e09e36

SHA512
2f3316629f2e3fcc5ab0847f24b4cf2da9c909c1f9e3c58342a7fc3664bee860a89998402d838c21e35d84c3a1b3765214fb8c9ec2e0ced2f3e5608818eeb62c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e05f9d9a056d3b99a768770b80a90e38

SHA1
1798071f3f4d60d9d1082a6502af2486bf5e45a3

SHA256
58cc53a7ff85be898a8173f54c9bd9781bf7bab9d71ec86c984b0102c5c96ac5

SHA512
fc8c20a1e6f41c589afdaa55c65aebea1b9c5997dfb3e02fb2528799508cd5be1e702951d3965e159676abc791f3f4c76d33534cd580768e1862cc70851253de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93b10a203dfcc5ab61299b1033473aac

SHA1
d176fc804561c6e2407c4c164cee10f46549c475

SHA256
0a7c0cee9c0753098ed6469064a28c84dc110f6779c4bc7cce4190aaa2fb68aa

SHA512
f65fad294c7a527aee396600828e18e1533d65a6dcb8f0facb7942e58f5069796a91e7ff4240afedf6bc7fde6e43f2a785b32e4c48b38f72996d28d93d8bfbd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea967cb76d2c01de350d81fe633bf401

SHA1
db01f652683128838ce59c803a55e12bbc948575

SHA256
5f342ff75d2959f0a7409a1ed8d982f413462aff67c58d4146996fb7d2f3a6ee

SHA512
49ae318a7540cd8f217540a330db6bddb45988d8180a6691e2b2d3437848f7a3bb81c5f8e3e37c75f82977a454f8a673a662c0d4055ddde036315ebb0e1a777d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\cb=gapi[1].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE16C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFA6B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit