e71a554cdef23af22bc6cef5dbe8dc7c9db06cf64ca407fd3639a69b9ab7906e

Analysis

max time kernel
67s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2e808fa7f0790c82e78b7689faebd54c.html
Size

53KB
MD5

2e808fa7f0790c82e78b7689faebd54c
SHA1

a313df69d5982c8644733ff4c2196da6138b126b
SHA256

e71a554cdef23af22bc6cef5dbe8dc7c9db06cf64ca407fd3639a69b9ab7906e
SHA512

14c65917e562164bd0f390ee541ee18471c4f9afa8b6f34636f12491b0d6acbfab7a2b4667872697cfd51c4334e15d033c8995fe0637698670c8b33e0079d751
SSDEEP

1536:CkgUiIakTqGivi+PyUNrunlYB63Nj+q5Vy0R0w2AzTICbbOoq/t9M/dNwIUTDmDc:CkgUiIakTqGivi+PyUNrunlYB63Nj+qG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000b34012098be06e769e16a52e617fff13279ef9054207bac7327273b6fd1e7c33000000000e800000000200002000000084a646efc8409d42dcd43133455b76040dd3ce6b541000c03b0b105ce22de393200000009faa0a85a8e63f1d170665b4aaf0f293ae09aa9f72fed8d4691aeb8b2a206de5400000004570c82e48bc8bf9aa4a450836d71b7f3792b95c57ed76fa5c7df983c81b6926f21d3fbd76d33b9b43de674ef462b75bf172b807794f088c17de755f9b7ea29f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45848931-A5DC-11EE-87B1-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000cd36747c53ecbba660f07b28b430d3a3273554c940283c57d49f456311c47f0c000000000e8000000002000020000000007200c933cb5188e6ec24c77773af32e0643d7727501f5895d0b24dcb206df99000000045e0f1dde229a09ed836a7bb000096d0c3edf1f6bfcd68346e93a38ccfa245dc707c2ee9738086c8035eaa145842f4f5f62a9e7b84ba0aaed31fff8fd074064ac5f265709537ef22c65102d2cd7a3f644a0b7557db7fb624ca6d167eee1f8f0fed5c088a48b7bf0d4f6c5a5f023e77390a48b5c5d9b21b223a841cca69dd0e0c4b4ca5da494423063acd01ba12b5c8a9400000009fd98fb2555737966be841207734177127f06f36bd340bdc2ea3d01bf5fcf132e77ffb2cd6127e120666e7e66d6070f84387d6abd1ad557c4a795ee2d4620f4d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f9bf2de939da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2636	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2636	iexplore.exe
2636	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2316	2636	iexplore.exe	14
PID 2636 wrote to memory of 2316	2636	iexplore.exe	14
PID 2636 wrote to memory of 2316	2636	iexplore.exe	14
PID 2636 wrote to memory of 2316	2636	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2636 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2316

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e808fa7f0790c82e78b7689faebd54c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
573dbada1c9154312a2997fc3b6d736b

SHA1
0c33385fc8dbbea15d2e69fa268e960f55f6e505

SHA256
343e02b8b9e358e00135384be8186d6f83de5220cd3a3ad9ce58af35419979d4

SHA512
2f5b4cd532c7097095d452e0af42f8ecca9d154965567260b4a35ae9dcdf25b274ad421928693682c292502e7c80397e94fbc0c45ff4581623ef078c47ade9e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f2b93e3bb309b88c1e4ab87722c61e0

SHA1
fa811519ccd2d8bbaa9b198c78d03921cb9fa5d1

SHA256
7984a970878d5b2b50e9926ea1554b6ba5d701a41815091abe59cf46b81bae7b

SHA512
ca17d6ac4080be5f7250254de10e46896c34ef907d35b145c3317eac44ebfa9e02ef1da7059e07d0bcda9b630e4d8b79052b569289f871d83a3edfe8e3c35c5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52f0839f1959cd9951f0faa5578b06cd

SHA1
68d27d638aa786374d6473a169179f8491fbdf4e

SHA256
684d7b4115a4f094b3c8ca0eaee3cca4410429d62cb965c60c36c3f140a0622e

SHA512
66b47fbb6658d203ad638fd41a50b1c442f8351a8557d253c26f05c833d0935b1bdf00bf23941a81b1362ac2421b26e87b98124bf125554b0f0f7fd974d9308a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f046b27bb3e7f92343fc5b5444b7072d

SHA1
04923f30fde70a5e4faea9fd0ae62bed6e5a7b30

SHA256
c6fb59108d540b1bc2e74537f7a41b24cdda19a982836de2cca3f6dcbdf54cfd

SHA512
04b20964470c3d29e221d15b57f88b2d5d2cbca047f05fd43063f19edf502fb83dbb3fccb79f38a9588fcb5edbd216e9b6ecf8413d6c85b1ce72b4e1b029c91e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fccfd5be338a70ba938d20fd8e4b3249

SHA1
f1001c4f52fae084448d276dd1a630d2c6a0f76d

SHA256
4c169954f482c0c329ba6a6e8f0bee9e0267e1f8e59dd0fc6762ba1c500b5a24

SHA512
a88dfd73c3ca359fd606b876a9708527d83972953dc4b134b77e040238ba77c760a95a2e93f7a38b8e65b832a689f08eb159acf8e1e70ceaf0126d75418e422e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d5dd8f12f803851b3a3c1d02780606f

SHA1
af185a3d80d41521d3c932303a822aad5dc9232d

SHA256
b3eedfb4f07d54b1696d33ca045c85f2ed82d5923718297bbf8454c4f8c51de4

SHA512
2d656aad1003aac1a5257ca28161a6f338e7aa6cfbb3f8fb4e45c32db29be7304b804339aaa4c77c799200abf32565ce062a7004ab5a0b635bc5f09bf90a2502

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a415e02d6a0d55f85a071202127e69bc

SHA1
34b4768019ced75c352671bff6ab607500827a34

SHA256
de311b72317688b0ab3b44e5dff12f24f69265fa885448e9d7f70cf3b442f4b0

SHA512
9fe1e8a502f1fb6dc902e0b2630e27596086dea377e6035d737598bf38dd2fd998d4a8a2fbbd75cd321bd160a4b9d5415175d3b00e72c12e37699566ced4e3b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df93fdce4f9638fa82a8d9e4d0d1f615

SHA1
65991f076971daa9010c644b076e4b79010cce4b

SHA256
5b29e9034d32114f7fce7fa638c05cc2b52180b11669c9e3eac221e227cf7435

SHA512
986014b08ec6193cdfbf6d062f3d21161bf36abb182fafce85215840e15f4626c3002383420c9fe38a7955d5c0c3556095ae48ab3115a34a60353e0de2bc5ae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b4e131e1fbbac402f25cac78370cc15

SHA1
f1072b55684087b22fc8fc523c3b443105f97d12

SHA256
ac792da8edc3eb7fa8a70cbf3da62d5c49440e5bb97cbab659d8e1c94e248144

SHA512
3e72a621e8cff261efede771a93e30bda0071957f5cdc82cba2330d4adff12c8a525b53643d411029c656805d85b3a21e38d3d5d444e8f740b1d81220265e6f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\script[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAB8C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAC4C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit