e65bd4bfcd02fe9982b72d9c0adb1ee9d06b293085238a39d1a64ff3b6d67dc9

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d78059b17b12573393bb8b3729f545e.html
Size

57KB
MD5

2d78059b17b12573393bb8b3729f545e
SHA1

437aae161cf5234b4bbecd627b4c0fc87abc0d2e
SHA256

e65bd4bfcd02fe9982b72d9c0adb1ee9d06b293085238a39d1a64ff3b6d67dc9
SHA512

d8336e67aec118eab676efe8793101f2a03362914f93b291aa7336e3378dbd8490370ce0e19be5088d5fbe990fd9b00a9cdf816d7f381bb5884c37211a9aa80c
SSDEEP

1536:gQZBCCOd00IxC9Z2Vfsf6Ufnf5fsf2fbfRfffMfAf7fQfZfGfmfDfXfGfIfjfMfb:gk2O0IxjkiUvx0ODJXkoTIhOu7v+gbUj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407d903ff537da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409754740"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000aa3e3236e19ada6a92ad1caf1924343e710ff3e23def962eb58195bd4336d2c7000000000e8000000002000020000000565544c9c09820fa3168b2ec95186ae1905b9b99413d067293ec57533446280420000000836973871f3a04112ab7a29e971ae8eb702407c061b59320d5debd6be658a95d400000005c960e7e690f034c7976e6a3702619d8ad56056f44a27d8e942ebaea4f9df50a72c6af140eb66ae2a0fb612af26841703310814d03f90f7b6f45021d8f3a0b74	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5196CE91-A3E8-11EE-9D00-76D8C56D161B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000172c74fb5cd07015a518bf86e0624434e0da5c99263e45c456888a62c812f1d5000000000e80000000020000200000002b0ee224981aa724368fd5215378883e3f9579213e1d65a10da47c963afab2aa90000000deff2de2540d09a92642b1874a40e8bf1f1e84c42f19514aa5f74a26c2816f6ddb229a8951f3849287b95647b1a010f20a7a6c780494cbb3f3ff40ff9b86c8b6c0c6e0546898fa1d7db33a83744c4f115834e54f5bdd3821b849791d79d6573b5bf922dc553358c49f22a37621178f475ab819c216901d4fdaf9ea158d640937a64effbf0e47a3a1d998428eba2544ea40000000d3f21ab0d0de07fcb29ad43e6eda3fdabb592cbb049585972d4b8197383f47bab6d206fd2a201f2ccca6db04badf70f22eb6e3c329b949e1b00ed7a90de59a56	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2052	iexplore.exe
2052	iexplore.exe
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1672	2052	iexplore.exe	28
PID 2052 wrote to memory of 1672	2052	iexplore.exe	28
PID 2052 wrote to memory of 1672	2052	iexplore.exe	28
PID 2052 wrote to memory of 1672	2052	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d78059b17b12573393bb8b3729f545e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a99a4a4e43682979196249bf98fddfd2

SHA1
1bedd32aea7a1e8a258416b4edc1dae94129ebf7

SHA256
a8b707774d7a42f1763421ae11eee29753b197e8fe9944c1cb77769babb452bf

SHA512
a0059dcacf8fcafa857a17559557a2f3e93b85618992fd19344089ae72a1e5ac38f6f12b73b7360b2ee5dae33157ce6e40559204c0060e18e907647273e912e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c378b54789dfead86dc5c047e9d59b8f

SHA1
a68045a339721bbd7f7cbee07813a9a31c3c72cd

SHA256
28cbc9e15cbdbc3317109faed109c301fbbe4e36f67f612dfc792964d2d0358d

SHA512
110006e4956aa3f78ec2c860d3d180677f9ee047e01e43e95ecfb60d57ac42e3cb55905d163dc80e12187d439352b1e067cc958d29fa3b7b29aa49c3408bfb3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7133c3804c5490b159d029ae22b7343

SHA1
2031ba548b346e62bc74ac051a455704599cb27d

SHA256
3c6fbf6f83ebb86eb25398c05c7ac9311b666aa59e2c9ad20ef30ad151d1cad3

SHA512
9c70b7179bb1d49b165155215b45d266a5efd0f686f4e9c794e4eaae63e02fceb21826757bf72b3fd9f1cbc2a12e99036b9d1bf5300952fffa191334ec61b38f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23cb2a75b4d1258dcf48965275534a1e

SHA1
808538c0083ed6c09cd3ceeaaa6486eb3b8274b8

SHA256
467f20ac3efa402d98c45c08ee3ad9303f385ab3dbef473d982d337bbc966b06

SHA512
7e773cab97d9672559a2c235dbe2be893990ed525e56359c70d71c298ae1e8389584a8da6de5ace83092ba4f799b92b32dc2a506befdb093f508a3b4a7bd284f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a930ade60f8ed6988692d7f0649f5f14

SHA1
5f82a8edda2a77416f7892d06876bbe8b8881352

SHA256
9bbb674f453e3b31105c45bfd35c859c82d8c9e95e190fa6116b1a04a53f6298

SHA512
8c238ebace439e625a2d984c7412dd7ce2d2dee224d2c5fd020c1f24e4b684e420371ec02c2adcd19d056940d3af3047ff308ba4814d72dcefc7775963beffff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
506485d664aeaf195ce61ea574e02bb1

SHA1
d38a9052ecd9d5c62be09fff728cfe92f6cf7e99

SHA256
4d5158d731c034427b416ced5eb7235ab4994dfda3b9b499f3e907a2b17201f3

SHA512
2e6167c957cb2a6af5d16cf91e3db4312cc391064e85e8863eff807f89ccdbaea8605f10d38d4cc6ae8c3742e85e6a75bde990484246c1e78e6919a78b3850fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2056f4d828084825d7f5bdd1d5bf6536

SHA1
7dc77be0098a0be93b998bddecaf281265018dda

SHA256
67c4ab78cc578ef32e96de95b52b1a6eb13bb8ae0a9169ae332dc60c1270e75d

SHA512
585d7088397ca62b5a9553d423ebf14ff1142ca130889183fb2bef3bd7483596286929ed59a9b3244a6bddff49b7b6cd9fa30223d06b110b82bc2c12de91736f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fccb599d0cc49464a175a8a6aea72bc

SHA1
ff646952d62cfc2dddfd008b3b27f205d7f9829a

SHA256
2dae8055fda9eff4975664a7ee2650398f5bb54414fcd0b9ada84e6e07d4d518

SHA512
02fb76b818764c0b870a2d94daadb039836342624defa0fd8204914fdb210ba447f5df4281045eb8b4cd2adcf29ad5ee2e16c93b5e99f44eced7ed7a1cb8951b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bbff39edc38f8fbc98c96784b0624d2

SHA1
ae0eca6aa28a3673507842f9db396675a35be901

SHA256
04f3c83e6649a4d726a7cf3fc2fcad3a06eaacb7ff1802ca4e3f565dfeefbdf6

SHA512
c84f7e434774e94c00b2fe0c227337b84f659f3bb2b32381a82c0521a038c2c0cb7c790c3d703b93056a0782b48e05c2a2ba89bb9105a7931df5fcbec4f55c7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6fc313230dfff13cbe465f8504a1538

SHA1
657979f169af47623d16193aa572e08426914fad

SHA256
fb1e9adbcc0ac0f765e162b3ac2a0ff6bd53eebc51b04af9028d5536bc677f13

SHA512
8a57632ecfb20cbc8374108fde79916ebf858d2288434acb39c65b203a9df47581361cf61a78418fb987ad34a0c6786317e352fd7ff9a866146cde1ebf964a88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46f1e10718966314a05fabb6232b124c

SHA1
ac7c0f261bc49003534026774d648238c303a9b6

SHA256
5f7319ab09b6811cb8d306c240252debd8c61d3c2cc6cae31b3976a7ad105063

SHA512
f409dd35adce82178550389657b8778fc94fec3bd12a08d626ba36f71bce965ecc48fa634e5b8d1b9d0e895d6dcc0f203236853ae5b6d197c28fd1cdb1f11e4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12d788e9158783bbc9329196c27fe3de

SHA1
5c395b49b3a5236b79dd665e967c1ef7e171ed9c

SHA256
d4bc70706a1b84ce4fb85d4d71daa111d7e8d6071029b2ed1e6ee2cd8a32d599

SHA512
aa0ab8021784d84d7c003d900b94fc6c955093c44231d6066fa47f56e4152bf7fa72d9e2627caee798920b32f5cce43b30fafd17f8138e642d9bb5d7f129b34c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d201f81c6e01b536da2b94b5b9992b1b

SHA1
4d171968029b937577e0bf491a27f455015016eb

SHA256
70b4de9f53692575b7f302bfcfdbdca567ffa3a8ad647b132a951ac2a644b8ee

SHA512
4541476553ed8947704605640d657d79510fd822e1163c3db959eb75068cda0196ae6abbe77a6dd8b8764fa188344713100032f1cf6ba93731611cd3817a1431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d015d798bbac2473cdff09a4e4c3841

SHA1
1a79f67279b26dabedcbc78c629ba66a599af6c4

SHA256
331930da53d7dab69c30fc979565ab36f37d5837695218eecaf9a79c3ab54872

SHA512
8cd9d13c97814881b8f7e9bf555bfe13349bc91854d70781b2744a3c249eabd0d3abff6b07ca62ef44cfc02f1a724db3a8a8422d775001ac66598d71bb110757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad5b6af24d84b60745dbc4f82253e949

SHA1
7a12436da55fb6996734ec06343ddb7d7eb6cc8c

SHA256
ab62d8ee2df62ac686f54cee00e27e42158d49416d4bc30d7fc206d18c58fdab

SHA512
6ceec1bbbbf2627236db7f8ce548962c0206b7936bf7d23d31679297b84737c0326345c9b049e59cbac59b164e6623c0452fdc98d678484407291afc9cc367e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acbe9d3e9b5e0e805b17c5e0d924e190

SHA1
8d7250eb511580a868209807b5fe9ed8ceee9a58

SHA256
0fa77022cbc83a66d0429b19f2eb601d6c28a5c2fdaf5e4f4d30ac73dda66446

SHA512
10fe7a80dc5501a87e04bedc4b3352a9f097553f9ae1aad5cc9d9029ae5a551473a5ab049c28b756859f0bd3e91f145bba798f39fea02d0c3b73133ca47071d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9FCA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA00C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit