e991d36a254b73d41f17766b46833307bc39854147e103c790bedd4b6aef28d5

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33d8e80213c6a7eee96939c624c2a0e5.html
Size

53KB
MD5

33d8e80213c6a7eee96939c624c2a0e5
SHA1

9d2c9396ab916b5e2eb3af7cc6ec1cd9fc5ef26f
SHA256

e991d36a254b73d41f17766b46833307bc39854147e103c790bedd4b6aef28d5
SHA512

c455bf78512f83634f54ec724ab30617a8912a476cc707811f57c478dc78adf31645d6233cff5620dc50841ecc112d902440ccff67f54f17ab8fcf9df7117f08
SSDEEP

1536:CkgUiIakTqGivi+PyUdrunlY863Nj+q5VyvR0w2AzTICbbGo5/t9M/dNwIUTDmDL:CkgUiIakTqGivi+PyUdrunlY863Nj+qB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80251c6b123ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000008e1d28751ff47842be0c0b4d619a282908628d885a62ecdbe46633769030df40000000000e8000000002000020000000fe8a85a0430dab2b5864372085ecb1b1493712e6fd6ee88751a3bdff84e7ed232000000070fe2e5f6146ff4f34604d55f7a0c33e0df7385aa66bf0b043ec6d75046cf63a40000000b5c6fa92f2e67ca8ce543f0a1971642b80b06ccbd60c39ecd019bb18ced0760aa367895756f5bac581e2657b29aba0d50dc2296c52cae20dbdbf42755a49d5c4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79C21D61-A605-11EE-A731-CA4C2FB69A12} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409987164"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000006dee6072043fe69af53ace9b917fd8d8c2a7d000825f983437fa364facc16d0f000000000e800000000200002000000055ac001191df393e6e92f49025ef08aaf03e2a72b0c3303a64860e05ad8243799000000040cd8a573bfb30f57cbd5cd50477c6d20065e31f820184d194db1531699a0e44280c73844388b216d5ed49e473932c5b22254dca1a8be17487cb403604aef694f28d33c915ef08d072ce5a97367f468c4b830fbbef54923df0b09bf7c400814cb0f3ed1a9ff32653b488e2c7c6b7b8ca984b2c4d035bfaadf17e0aea59f3dc0ce99f4b0a70fa90dc1567a26680a6cc504000000012d9bc057b01bd72eaa7efe0374adbc9f8e473614d65c228042ce789f46d02ac66147aa04cd93c5afe0b840f9ad74edb06abcb6654e41c267ae89e2dca5ea574	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2224	2032	iexplore.exe	14
PID 2032 wrote to memory of 2224	2032	iexplore.exe	14
PID 2032 wrote to memory of 2224	2032	iexplore.exe	14
PID 2032 wrote to memory of 2224	2032	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2224

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\33d8e80213c6a7eee96939c624c2a0e5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
888a8339471279382715c7cafc391b25

SHA1
3c8f0f96a1987ffb331eb905095803fd6d9f633b

SHA256
a56c3c96de43fcdaada6ceafa0b56e3d2aca9821b652ff5e94732a0a02b7fbc1

SHA512
ca0fc0dd20ecb0c8f2bb54834a96fcebab7375dfb6770a609d649c7fd6c8a2afe732c3ab37216bbae66169ac4d9be7806c5570eafc9b2ac944bc7fef06286623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd72f8859a14651fd4daeaff1b3ac023

SHA1
ab1aa7b684f85618ab45c156df13eefc1af001c5

SHA256
c08ddd677b6a39cda9a99e9a3d39cc9f14c1872fc17c02a5594b18dceec31969

SHA512
e7cc7b7076696e806a1b911dc75789571809b0f03206ae5d89bbcfe9a2a6a9df7ab57c4b362519208646125ee80a3b41ab9b6dd4c48e6a476d570f1f9da44bf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f26aa06dba05c203c0aca99470692c8f

SHA1
8a42b51b8da4ec664902ea785a2d036a4c5a0605

SHA256
69e36ec2d8866e4a09f0e788647fde0edc576ce4f490e2c89cfde96104343ec9

SHA512
6a476d64b10a61ab694269519499e5b6bbea24e11b526110a4e536b2aeeb2cc565973d8af9bf2f5add21b560a17c42eac822b4241ed314a083556e6c83cd4e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
072c422f16efa7dcc30bccf993335709

SHA1
d734af279d5bbb9d713cd2ade67ceda153594707

SHA256
ae8d9d655a7e1774a8dcf75023512156d9d111ab8d98e24380d33798d97c60ea

SHA512
faa65c3b006078519ae5f7e76178f5824c401a859b5611778f9579cd24f399864b1362a7958093b201e418949ff25038e9c5d8f4dac7675bd1356cad4e93ac62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11d45a407dd07f26288acd2de5ea5e21

SHA1
5265ef1313c1edc3ba5e97581ef27738cd8be843

SHA256
1ffd1b66e533f94037cbc0f119122e00fe8338feec4c4b90013405361b69dc20

SHA512
9b8bfc59966ceb3c9e468f71d44f6ebb6fda50b3278876ba755047548fc6a2e6d7107d85101873a82537bc4d3f7d3056dc368300c1b4b5a90de258fda0c12bbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1553dcdf22f6b59085f56d6d21ce5eb8

SHA1
403b0839d5a787fc49fad81c2f5d0edded30dabf

SHA256
48639782b4324b8e5a5431883b978dfe06bd9685cc37d4b4a49ffe473e99b538

SHA512
044dc6fad3ed9b3fb59636e6c2600f7cd7a269d006cd586d7b86d6a637ebfcc47f50e7936b3b1b4b213dc13aea6a63dd8e22f5a3c550203d73e4fc0c7c6d12ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48659c45fda7db4e5a9cf74e2b2b7d97

SHA1
9671cc2c0bc57eb68245440b13dbeaa8b7608b66

SHA256
5c4197ebaaa48ab029d8013329e8566b7bd93847c7ff6d9ab45488de19e93333

SHA512
85c845afa48732037c514983f3a0b6f8ef238129e3680722b7b2f08d9b2046ad0e351f3c1802bd2ebeb3d35ce248f2606b924264c8a293c1c02b342a86110040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f27204c3d947bbf6805d5580f923145

SHA1
30875197d192e006490d68f86499958b86777b4c

SHA256
9cdb4fbc5eebc2dcfddcc4ef550fc220fada2198e667c7851c95e6e23e9f8a95

SHA512
50f5573feff854a65c039485b29467ea791e50e7b30865b9a9d11b7df11d85bddffb87315db94956cd60a0f9382e142cd97a5a19c674970a27c4ff0bd1f5951c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfd4543d0c9e1d5ec196b41a525652e8

SHA1
12f2a46bdd9995b540f10567fed77bb5270cb71d

SHA256
b99cfcb71f13d6beab6ce3245ca20500430d1a0e45d2c0c03da07ded926b3db8

SHA512
aaac9d4824f20f81d44b2e1f8f037fbba0c115a0d96193e9e1fbdbcc7ea0ebe0308497f6b96a3b172fc2b15eb321ae251d1599110e185c244409f3617bd1b011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IKHBZR7I\filter[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEB4F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit