e062fd689f38b409884b1ba8521d39b9c25e0631477436e279096791cc626f7e

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3802c549a6f84ec7712f8a31422a3837.html
Size

78KB
MD5

3802c549a6f84ec7712f8a31422a3837
SHA1

87cf54712bb2347f3d73b4f0797572f9ea814c8a
SHA256

e062fd689f38b409884b1ba8521d39b9c25e0631477436e279096791cc626f7e
SHA512

9b4aa555b759ea7d6d39194822be68241e5ca2d65316835893809688dc239b49cc279e99e9de3c4527021eaa02eb6066063aed9f4acaeafedb1d82277ee8a24e
SSDEEP

1536:NHeM3RWIkpiTewFv7UFMlR3z4BrU78MzKu330T/ez7U:NHeMPKiTewF4u/3z4BrU78MzKug/E7U

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000379b6f4b787a71e819536ed52392c11d8bacd3c0147da9d42c362bbea24c90e3000000000e8000000002000020000000658f19f0ca6b8cbab80bf109c78ace21b3ec3b98200265037ee698d1e558e692200000002dfef59b2530dd13b4fe7338fa1c9aeb166cd17261c6d07d0df735dc05d7096540000000ed9df1f6e5829082c733de568f3da5a59588336b6551160d842bdf428bb14977d17464fd04596855adf651ed2e92977530729f2941a878afd0fe95d0dc8e42a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000056146983fdb021f43bd99e56fab8a7d7602166ffc4d1abc7699996f6bde73f86000000000e8000000002000020000000987677ab2c0954866dafaa1816e59577726e98a0d8852e30536f47af71a6d243900000004c8dbd6b4f96c1a0af518a5f0c0fe3a36386b2f0a25efab1b1f3a84c40a8fb3e11494a008d623501b514d33f4995683125ccd89a5e5184691b6721b25510652dc89ab2c96e7330f60b91100b356bc279fcc152c0258897dfac9c2de72950f6ca885364ad1c76df1d01a40f54ede54bbe3ff1d0e4f5ad17dfa14b4106065f267811812367b471c62e9edfa20fead9d2ff40000000e902cd325f42c2a6010e3af472fa2289e673c71a966f4190ee7c1abf47772336fd4777d19519b875e6f4c0bdd38e2b64783595048d07218be6977b1e99748b38	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC898B41-A622-11EE-8E99-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409999815"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f3e2c52f3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2668	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2668	2432	iexplore.exe	16
PID 2432 wrote to memory of 2668	2432	iexplore.exe	16
PID 2432 wrote to memory of 2668	2432	iexplore.exe	16
PID 2432 wrote to memory of 2668	2432	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3802c549a6f84ec7712f8a31422a3837.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9174c178fa72a0f151324265329bbe80

SHA1
f696231c00abb6d360f41d57552a74082de0c451

SHA256
c18d7134386e041ff805579cbf8b754b58c9cfb8905f7a5c45199f2f30046ec4

SHA512
3a03c2d2b9061490dbb5f034c135145a7751005a29b2a08511cd103c136e0007e95d6e31693f919f8de7af828e8785610bb86795a74b640b3f94b0b6adadc151

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61ef6e25158a32570e41b5efb492be09

SHA1
4c3e96c7a0a76f91f1f9a04253cd7554b560b1c4

SHA256
8a9c7e9cb4903a0b69e2c17654f87aede62ce8113f2be13aa96ba39fcc99c7df

SHA512
93d45df37c667f60c8363d53ad4467f88bcfa9254273adfa6c287b752649e1fd9472d53939986b4227efe733dc671e51978e9f000edad06777a2072ea274a22f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
909e4c8d27f12fee998ba29096d8c40b

SHA1
cdb363b4041b24ee0a04f969cd093f0184c24af1

SHA256
8e0aba20f9e7d123ad1dababf53a4ca7df41ca80f25bd4f993406911adbb9796

SHA512
322e05f3ff5a19be8ef6086a97d6c404fea645e3ede5eb1dac37cdc2fb87a689f034ad8d7ed89a098c1d2eb9bbfe60640873a30567df34a3f88ea4969d2c22be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f2f767e831dcb876caa8fd9b6f11718

SHA1
f483895ad618405c3f5ad7eda1a6e4a9d79b826c

SHA256
13dc14fde65cf3db156248afbd2dbf808cac6f6075acb798d8189f175c94b578

SHA512
d6b6141b80786cf71b4b079d978ab151e42a7f52b15a80da184f81a3eb81a393961ebd7195aa0025140fc94d525e0836aed7f9e78affaaa0f8669fab04d16273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9be32cc027ea9805eed549a9906f7497

SHA1
a772272ade17c76753efc835628df976ab8092a3

SHA256
82cb714a4d61c5107ed0247c4615312b73f35383e1b6fc46fd5a9f5dd14fea52

SHA512
b1d63bee3809111500b215e51ecdd04bea64837e6619f3b3f57b2ff78e094761f1184b666fc82c8ca3ffce014a2de08d063820c7c8312ecc37d4a094d7b1f3b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5e001ee887776233a9112d50aedb2fd

SHA1
b39da7a493c9a7cb736dada583e59e2e24ad3eac

SHA256
c8a5e3aee430dadca020fbd68b3c951e1bf4e5d9b2beadb469af66e8709378ce

SHA512
e93a82c96b7d090e16b00aed9129c986203dbc1437564c46f8a6220138c74f49e20d3a4436885adf8bb3e87162b61626023b1bffbe94c67e3a8bd6fea5b3248b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d39af6483bac2c2bb24ea2d2dfda8dcc

SHA1
3ab1b0da2d03c7a38bd192f2e4b4b1f2a2172ff6

SHA256
dff3c97cd51c3bf390f5c3156df446352f2b4ed42f754d1b3b942cb3371a93c5

SHA512
b8c384568b288d9236fcb7c490d432e23401f0956cc93633360a090cf58da6694af1c269e7d8a616b6fbd10e1117980932a2437346612821527c2ad63f10f10e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bef846973bd1d0a70086bfc4d6d2710f

SHA1
fc22d37889cb90f1b868acd8433f01f327821484

SHA256
f96f2ac1e2b8cd1111b5fa470335145a2416aea89ad7e956221cbef5775632e4

SHA512
e92a42b07dde3e7d9a0537eb078e808241c74d56cde9b831d64a0cfb5ab32764efada95819db5c27a897d570ada7d819a100cff9e7b69ee60b40adce0b7712e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8aadb52e9e7d91637197165df20998bb

SHA1
777d2bb36cf77cc3e9d8e7d434e52fc14a1d4990

SHA256
14c63562434cba6ab3de2779d405257337557affe72ca12210c39cfc5c88c9c3

SHA512
aa7b6a3a846f45fb1d488d82dfb5c8a3fafad4a94b3251c7d988459e060a182d4eff06f6ba0eaa7eeb4ba3934a29b7ac71dfdcc44bb5bae4fb800794f49f5a92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d538a9c7e2efd7baf921fb3616064b25

SHA1
4a3aaefd7f2193dd1d47899d3b70916b62dde95b

SHA256
73bc15569618d9244657355a655ff612bef4597404baf71aab33fdede2aa0252

SHA512
9df3c43a92f370c533cba8dc7aa9d79b4e15caeff5e752618213e9f78aace24fb61367c10d277310eb0a174711c6ba99b704f4929a6db8bdc7bf900e63cb8e7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55b3d122c96a271d7297c3a88a79d378

SHA1
bb2a7b9b74b6c39ca8560ac65e8d97fbcb632bdc

SHA256
36d381d884901aedbbc8cc83ee581380f71c3b1cb096e6261e9709b7e422ff64

SHA512
d991adc90daec9fe956f6691b2adfacfe511c76d7dc081b9f6777f63ee40d2d4dbe23ab510723a238ccd72083a48ddd5a37bdb3eb42c0301de8310d717797106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\caf[1].js

Filesize
145KB

MD5
7c3436a58816542d224f1fbac2613c76

SHA1
9c25441ae757323a10826012edb2d934acd84acc

SHA256
897afc7294feac4b7766c68620463889f318dfd538197a8f35d0f475ea05adff

SHA512
83e3209819fb7c37fdcd3aafb4107207059f8bcfe3165022ac6a4f897dcece076fd1f098d283dd6f66a87bd49446e645dfafae7f08a6183211e1b261aa9eefbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\go[1].htm

Filesize
15KB

MD5
6f50cc8bb09d7d50a8a80724873e5206

SHA1
b9f2fcc5eff10570d21e1c70ca20eb2011a2fe5b

SHA256
7ccdb15071ad20495bdc017cea40a58af01c5805df4de9ee27e2f7ad22549f54

SHA512
472efb7c904376d622ec5b3908ddc3a7ac4fea31b4148b184696243c342ea4275826efce751bada483f07b78a2e0517010e9c2c40ea96253b884d4c992f7848f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\px[1].js

Filesize
346B

MD5
f84f931c0dd37448e03f0dabf4e4ca9f

SHA1
9c2c50edcf576453ccc07bf65668bd23c76e8663

SHA256
5c1d5fd46a88611c31ecbb8ffc1142a7e74ec7fb7d72bd3891131c880ef3f584

SHA512
afc3089d932fb030e932bf6414ac05681771051dd51d164f09635ca09cbd8525a52879524b6aa24e972e7766ddf529484cc1ec416de8b61255435a89ba781f8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab283B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar283E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit