402360bd904d48f0799e2c7afd414ca0e47e4314a97f402ac9f4682b1c688613

Analysis

max time kernel
117s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29ae686637d6e6125efba767a68d2185.html
Size

17KB
MD5

29ae686637d6e6125efba767a68d2185
SHA1

6701b783517f9c7287389d3a7cd481f97a6bbc02
SHA256

402360bd904d48f0799e2c7afd414ca0e47e4314a97f402ac9f4682b1c688613
SHA512

316370af4a24cd9d55137d423f94719c0ad5a42b8a0e79343d8b7d81deed25c92fd8793271075fa2fac2bcc5d6c41603655532378c080ae7c3c4f5302c3bc56b
SSDEEP

384:yZqlPyaahr1AgdGgs8jMaztTLPAuz68MMv07X:lltK1AgdGgs8jJO8ts7X

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED920491-A5B4-11EE-B940-464D43A133DD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000591021d1977b1445e7015566bc64c3670f38ba421c58e7abeb0877e089781659000000000e800000000200002000000028ad29b6fd68718043debd301bcac710a8411b246b064857608d14b5200e1b0120000000e848db81535fbe36b4ce2da62c41841b455e34c9239a644141e457fcb9871d52400000005083f64cedbad54aec87cf52d6792f2ca41c05be155aa758ba81ac097264f760c4be844afb232ae1d500ae3151c5562589f3f9de6689f087eb43af5ff2f6e53a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10bf1acbc139da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000004a291d7c6f8e2a43664dc83013e4fb238a3ba0f6053422d70bc6b15d963438c6000000000e8000000002000020000000326bae18c0a167aca51ceb1b8375c34a38dd5ba2575cc5c48ac8d8864fb9b13490000000b51a8838be1adfc49ef1f45ae5b219436b496a5469cb716ca85dbe95998a669910d0142e41b9165b8f88dd86f2d3692baadedb2583b83749a943421ad64057d7b624bd7a8ef82dcd76984f32d33f490e7e078326b0f35e098cd5368a8fc467c362b487f7ecdba6fb46432f94268174363919f67d24773554cea253760c4aaa387f52bdd207e2ad64157aa6e53afbd52240000000053bb835e15c25c0a6413770a2ff8de440db13bcc9dcc7dce81c5e5efdee42556ecb317ab680ae4ef90067de1bbf37c09477f1b194fe0ea9adb48c9131955a7f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409952583"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1864	iexplore.exe
1864	iexplore.exe
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1732	1864	iexplore.exe	28
PID 1864 wrote to memory of 1732	1864	iexplore.exe	28
PID 1864 wrote to memory of 1732	1864	iexplore.exe	28
PID 1864 wrote to memory of 1732	1864	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29ae686637d6e6125efba767a68d2185.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00632cd9fb7fce4f7e54097774244b4d

SHA1
408709f896182dc26168ef07fb0f49179a214e45

SHA256
c82aacf15f2bfaa0f3b92107146f86fc77a79f8ed460b4c8e2e282d17bccb9b8

SHA512
0081d84ced661c669e340627c45ae39216f5fcf2b92d01532e0074c4a9f5c7acf44eca11f08d47389ec4de4d3950f87a00fd1a849cb47fbec847f7ee3808ba1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88f89cf1b1f55b013ce5da9cc520a2a4

SHA1
91639458ada7e663e73916fcdc87ebd56f2f14ba

SHA256
569b785237049d91acbc85bd73e072633507cab6f5ee8c97d34a731d044fac35

SHA512
baac151677da388a2d4d5c40289300bf3021f5e86b5902ffc65ee8c6201add4605c012ae1d20d4c14a8c106cee74a668e202ad75b96cebf94862fba688981db9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c34b4b1404234642e95c1f93c63a9504

SHA1
37dcff2d19f48d417f077f73a8bdb24da7379ee9

SHA256
4709b44f46cb7f6cff0c1e2dfb34f59c50382e412429443675d81c2788da09a6

SHA512
8c39ff8247f540796cfb275ba071185e188a770b1d76717c50b571a0f9194b7de0a5d657bc865f992d6591deb5ad4515c205060d0273a295d4648e72106f5551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fd38a731e2cf8252370147ac5ac3690

SHA1
5313b26939b3c1e130a48419168c9139583f3e93

SHA256
e4ddfc14501d51bc4b50f6b0f1732f349ba0b69fa2b6b9b9bc81e68659b844d7

SHA512
6f7614951288f1381f13d3f99bddd501ae9c48498ce0057eb59739d54827804648a4d65bc584336a1bfa9fff93f0d561b731acc19dfc68be35b318117766e0c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8df7af866d7ce1e9f3de1d12492012c7

SHA1
00747e20f93727d30ea7b3f4b75506cb7d6d513d

SHA256
71ec52af7bb2d2e307ef3427aa40e710571031054c3b8b9a6b897aa9d336ec7a

SHA512
4ac938d49c987c904c54ffbcf96b1819308dbf626720a87699cc460b9e2e807fe93fdded7aa72996ccff14f1746a805ef7c5befe2037b21b810eef5d60b900f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbf8d7d4a213e212312a8513df3338ad

SHA1
76ca0c84db87b2858441076c468b5e2de2ec6bff

SHA256
7a294fe1ba795ded001c5ba2c2017604030cc23f8b1a63a1783b34d14c3e92e1

SHA512
b4d69ec7e594bf5ee01ad9d6d504d34abd55936673130da32f3a971df859118225df0e7277cc778d192bc91743c0462b5e23574cb9192fa45dc09942b21b29d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b998727eeae38a04443ccebc6fd27082

SHA1
109a81d5472c7aee9f44c659242a0caffcd3a11c

SHA256
3c2c59937f160d051cc1ef3f545c9c4582e9fbf56b56caa6f60637b26f73cc0f

SHA512
59f6a9b542b607d6fea64fd7e3e04201fdd4a4884fa47a7c1cd6468a49ddb6e533f5e4e16bad3d682db4204cf2d2f0af8e314482866dade526ff6dc62a4f4975

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e777fab5680f1601c4d9a95d89c32844

SHA1
f18015f52c1653b1f5edc24e9b6e35b03ba007f7

SHA256
c99e0148eec133b97e286040db8c190c777b96cee21c79e78316160b63c3d853

SHA512
ab9f973480878174bacfc00adf93a19b35406a3f614dc15e770db860ede5037ca362533f734e64c6b4de94056dc67a4b404ff9d8abbbe0d90b8a2705b0ebd006

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49acebc8e0fda22cc6d1e1bfe20f44ca

SHA1
5da11ab934dbb17b0cc5fdef1a6204dd0dfbaa34

SHA256
847315852baa91e5db134680df2b46ecdec67498ceb602133e212d1c24b7e2bb

SHA512
e7f12cf0dbf2d38adf58e1fcbdded9148ed15f2576fdebd785c0b95a2d8e81d8f0edf40524e7dcabb5e5627b87188dd42c7b60ef7a50220ebac0b5f565eb09dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
165baacf625174baee5379e3859ddebc

SHA1
8e831fe78ba61704805a26767b0b566064c4541f

SHA256
60337808c8de6c05926a34de9189fe3751c1e72a818e6256aa1e59ecc3ebd97b

SHA512
c354e5d61c0f8566d72a5a2393ff3d87be95d45fae829491816cbbd8404358bb9ae903eb7b7572289761d389fe83e349addeaa96c4b37aee86cffb10b0571137

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa4d741630171dbc1d8228f4c5b573d5

SHA1
927e2a8d8b05a4ada64a50143e1f2e8d7a5b30bf

SHA256
fc0929245e2087a770926ab520e0a1ab1ecb74547c747a37a752977dcab1b062

SHA512
1c779b5a85a163caba09d18ede706736a5743cfa7f589daafd1d15ca7100ed81f779407cafa364ca8106f2bb86e18e79811e45bc56632212b736ae40eb963116

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5B0D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B4F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit