e77732047e2fb1bdc35977cbdf12fd3feb6a6f069a83e33334c42a48719fefb6

Analysis

max time kernel
138s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

281c3005801c2efef81beb05c7e12667.html
Size

213KB
MD5

281c3005801c2efef81beb05c7e12667
SHA1

8b1ebf37197118a17ab21376f53fd55ad29afdcb
SHA256

e77732047e2fb1bdc35977cbdf12fd3feb6a6f069a83e33334c42a48719fefb6
SHA512

f3131e5c24d9afab3fe7faff012be24bea547622e04a241b92520d345d2361616d8d8442f95fac758bcf94f220a691caba128504eb322c8f4b4fde4fb5e1e420
SSDEEP

1536:3JGhiG3lBOOG1wHSn/EW04XSktfE5QheiaRru8u5RXb8jwjWyj4em+rbtftcXt:ZEiALtG1wyn/EW04Tpheias8SWctft0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409947382"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D93EEAA1-A5A8-11EE-8D93-6A53A263E8F2} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1244	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1244	iexplore.exe
1244	iexplore.exe
1204	IEXPLORE.EXE
1204	IEXPLORE.EXE
1204	IEXPLORE.EXE
1204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1204	1244	iexplore.exe	28
PID 1244 wrote to memory of 1204	1244	iexplore.exe	28
PID 1244 wrote to memory of 1204	1244	iexplore.exe	28
PID 1244 wrote to memory of 1204	1244	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\281c3005801c2efef81beb05c7e12667.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1244 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f551590ed3f7aaa3e546eb1e5cd95b9e

SHA1
598c1996ade076a8ef2d81a6039da8f6dd5e5942

SHA256
0a9d93155bb9cab2b03fea86681b2b081a0851e19c4e1db7f2ebeb682ad3106f

SHA512
acf860c02251240138945b01a71e7980437d60763a2f8ed2d1e85931ca02988675889be5448f54b3407a9ff85d78742ae00fe0635e7a72458c07fec8e8e12d7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3ba1ee7e11880a0f010aaf28e7de32f

SHA1
9bf577b8ccefe107ddbfde13857898805d81ce8b

SHA256
b4c67c989c75a8742514709816eff2659705cc2378c82dcffe10efc01e203145

SHA512
d985db0095395a302189c3b852abd3bcbcb5a549afa28dddd1852a21f9b948ab3dea376e03a15daa3dc87e377ee7ba78d4de7c5be65dee9068077150e64002f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be28d7c1070b975557325c6c51c5b9b8

SHA1
e80e89c175d09401aa43b28b56d95a5638face07

SHA256
b86cbe2ee09c2e2b5d2f0a0e1a11fe7ab8d86c9c8122b0b80668de6a9b8fd435

SHA512
af19a9d569af32c3799d65704dddf74a7797f3d194bfb7406eb00c0e9ebee34513728d2e2ab77f164cf6c7655457ad6f780bdfe8fc56911c95706ae224070ac2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f7481ec1411cbeb4bff28d5993496c1

SHA1
02b70b6c72d64ded79c59dfe46dafebf09617644

SHA256
c966bb4db267312c23caf16862eae2f0d5e8f48e718adca898111dcb8e896507

SHA512
69ada650b200d9b7148a28e350db5e13dd85ae944fc3e372e274cc999d6aba87a47956386e29168949729b29671cb581fc912e34d33fcae5d9ec8b43e957dc98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b82fd8539c866cb85e61eff05db10891

SHA1
bfc4e3dd6d47d3bd7cc407311a415b360f34582a

SHA256
95e0072b1491da23d626887afc2a5f0096119ed85d1d2b567851ef40b709fc91

SHA512
c9f28d9a16ee4aaf7c5be3be3d10b73db621a8ab04a39eb6a36b1084d185b0fa1532444e1c360b9f9c734c5b14fe5cabb3d26b4a8a8028ec6075a44cb5156974

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac48a1c8628e052a4b4d9b5205cbfcf8

SHA1
bbd7066ce94192d7bd7536124dade174caef0b77

SHA256
2766801e5683464b70000b6d562b1cb55bbc440e157d7f9f4394dc90bd9ec707

SHA512
11cd659b4b7a71ec047ca74ddc23415f8465875dc78d4bda9558a15b6f841a8116b08e107feedb68fcf8a350046d27b331d6685cded4330a2139c1a7c465f21e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68ed31b8b59a86a8a8f0fd9867bbb761

SHA1
d100bf6c8ff12496dfd6d53566b75193d7a80e31

SHA256
308fb9d6980657fe7b50fc0247b77e646841867c0d826119596add0683b0bfb5

SHA512
d51b197bc4720f46ec000d4e90939ed4c5f942a88dab3932934f2c67af19409b1db22202306c463178b8eb9c757c19fe09d232c46815d8fb139421f5093779e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09b38bd95b27c99dfe34d68c0effe07d

SHA1
42e3e0681fd59bd235f99f748ba2ce0201b91c06

SHA256
6a75e4b5ae637b98ee25a93e4e7b98d556c2cac62928d5b6d2b58ec128253803

SHA512
ad2021fd1833b59c961d87f5790768529a1160e49eaeaddc9c1edf20334da37855c9a774363af1d7d685fbeec5219eb45a953239033dd7f89a3309ad79d6e445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c51504c9b8bb9d4e155bb2047b71f09

SHA1
04254c3827cf41ab91d0ec1024cdb48da7a1bb14

SHA256
234febbe60b204fd11312292c92474184c5bd293c8f9e1415b66852fc42c046f

SHA512
1bdb2a29dfe294459fef4ad5869d9a967862c06773e18c1b0951357b09aaebe021de0060950da87493c7bd76b6db420f8226424447a622485f70c135ee5e6c12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b721c7ea1bf083c01a2ffd536ae6a952

SHA1
00d70c84e6860106adde613e6840648dfb45d4e8

SHA256
1dc751b80c241d28fc6ad8a655701ec5eaa2aaad6173d4be67b42dbbbeb0f606

SHA512
c14c6bee89e48e1173cdb0211e349cb85781f65eb4a0367aefb869df4e0e89699e6f7972a3fbd853ac05f1281a78ac082f2f8dc3b294b3b7eeba8326978dd2c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15b247a7c12e49599adf18a4dce2f6fc

SHA1
47832d7377cf03c578a08fa7cfd167e10c33cd68

SHA256
42b5af4aa8c9178a17dc25fc183ca39826f2eb1ceb20d5f3178b2d967ddab0c9

SHA512
1cc28e1ff242b7c0a7182fe951178d11cdc124d938ca06c7e5f02a3d307f1f2609d6bdd77c4bf5f469916d73879e1726d09605ffb3cd7d9cebae5072d705b1d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FIEDGG3E\httpErrorPagesScripts[1]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFLWQ602\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1140.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11FE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit