5a33d73c6bcb3d56b0170842af41c0dff443f7c228994c6eb928d2bf32f44418

Analysis

max time kernel
140s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

494100b355f35c92725ead703756e188.html
Size

36KB
MD5

494100b355f35c92725ead703756e188
SHA1

05845a47cc03625a7aaceea6f58655817e2f726c
SHA256

5a33d73c6bcb3d56b0170842af41c0dff443f7c228994c6eb928d2bf32f44418
SHA512

d8f53b69308475945c6c88ae9d05c25e8a9af69570e2bf1cca70efc4d84cf598f859c4f310413505bf2c218b707898c213238f8532c9c9e688d156d2b04a624c
SSDEEP

384:8foAMjOQXfRO12Or97NIgmCWI6A9/PmQ2V5I2+IGzF7JP+1BxbeVwa:uon7E7NIgNWI6A9/PF2jyzpuxCZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4428C3B1-A953-11EE-9853-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410350432"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b52428603dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000003d7689a91133cca6bed06f8edd6723de8313c9d6f1331e9d4304e1d850a27e1d000000000e8000000002000020000000c65acad2142b44c23ce5737101e03547c86d20bdfb5cb3de050438a45fba18982000000019066da5e0475e373bb696e35a79546104ff8cad74f35a58ddab78ec686dd26e400000009f061333ed10f51bd5a6b34497fda8c2b04b791901e67a4720a82ee862787acaf2c1b5c36e1928ee15001b937a40a5a0f8b03fff4dbbcc2df5bee681df0ffd9e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000008c95709900b2dc2ca60cf557f2351a2bfaed8a86f7afd8dad954a1c0ebc3d289000000000e80000000020000200000001777f68cb1bcee8b293b6b2b371610d0e964d10780a4b5ef6bbe5d3b6fa602d490000000b6157e54e1167408e71bb90a0e66811cf7fcd701b9188b1ccaf852860117ed18174c6e7faede889c0a0914fbd3a504f349150f8c5d3968d15ca587fba852d89106726eb0f8ee3f31aaf49d29a93d576c3e3ec381f5b23f7083aa21cecb8f5f4644081eba9342d153d7d630c97049889ef3485e6dbb5136e870b9d1c32436cf7a10e55ae5e9c469eaaf9ed1856e21d2894000000037550575a13a84d0e6ea8df9e3d988234c88f6e636f3de9291c8570128338deb18764d7c7551b42bf255ed0deec9efa9572b5dab74b53212d20732175d327ff3	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2860	3032	iexplore.exe	28
PID 3032 wrote to memory of 2860	3032	iexplore.exe	28
PID 3032 wrote to memory of 2860	3032	iexplore.exe	28
PID 3032 wrote to memory of 2860	3032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\494100b355f35c92725ead703756e188.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\04FC23A773A43B5EED263BBAF545D686_B5A4512C6B4B61D9BB9C93955EE9E79E

Filesize
1KB

MD5
9a884cb4a14500167b02ccc63b4b5376

SHA1
8787de164ff18bc07027337e24a7bfa135447050

SHA256
377a52892f86622030f0f5c7a3c2736f9d039e4e054ad7535578b62ca4784945

SHA512
5a33834f03db99fb4b75abdb0611cf555ffbd67d721b233bda8c84b6e77a9e4c4730dda50babcee23f9f12146abdbe807536135237c307d0ef95a57e67f270de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13e29434e9a519294fe9d099674b5723

SHA1
c0f45842534050600a8e3a9f7dbe0bf1192bf97e

SHA256
9dc5797ddd648655dcc5fd519aa8f9382ebe5d07e3e34a62da9f74f2f0db479b

SHA512
3f542f886fd084d71907c810ee8711f87c262577b511d4721334286f5baa70c27bfd2b120ca4df9fb323360393d327c2e0d393f1cb14d8f43ad0cd3253ba28db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afddc6619d9af608e92e75000016dd00

SHA1
039cf3a961783df460b8c08b8443f62c255d20e5

SHA256
c841eb884582922c8c4b547c8f7ee09cec4527ab123bffd85312ea5f3456c629

SHA512
60c58b154ca4c8a171dba177927064666e119f37a97ba9b7287a06d0cf905a0032e222c37b751130f2c1e66288bd954fbba7a90eb1b8f5d4f2a569d0071e6285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c5d72f2c4eb56d2c6d625aa512dd277

SHA1
e27a18cf2b587977d93ed5d3212c1ff40f9380af

SHA256
841515abbde4262380c9c251be81c464b08cd2b003f3395e8bf32fa98846b560

SHA512
8550e534d900fbc03dbacac11388f6f58c38452af2a7ddb8a71f1bbef64ee00db47550564380a9eb64d5425171442ae0f6098dba68adf560ca3fea48387c0430

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcbbfb738a2140876e79a8531f99f843

SHA1
ce160bfeaaf5d1b1b1bd3e9bf08dedac3ac21bde

SHA256
5cb8090d2c56d8e0a4fa7cbf7b3dab3997bc8cd807746ca53737f91b5e0ec050

SHA512
4e3afdd5ebdc74dd12da718de7574e0c54322c4b0f66ededdda5df1406030c40a7ed6eedafd98b2ad4f735072dfba3b8287ea301196e281d2096c33e019abbc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a68e778bc9b33f08372ccb561367f2b6

SHA1
77ed48bebade0f09e00b080aee35b9f5d30edebc

SHA256
62cd15d40134b808e54d0437b8b7a809b2caf0c62ab71fc81d1afc1d39e383bd

SHA512
36b2dd7d4db2ff0d49b90489dcbf2df07faa014679fa3d4414287f575e9b45c18696212074efeae8e36032fe59f31009cc53d527f8217fa7b2d4e2d0c70fc9cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ded8f034c482f4dca5fbc7e7f8537880

SHA1
7dc5e9d97aa4065f3725579a26feb7e2c84400f4

SHA256
22c669f20b3c8beb55f43741a83e3f6a277550fe1f2550dfb73815a82ffc64df

SHA512
f4554d57042fa72d05023c51d10f91f22a71cdbf89360ad70d121a7d02589f4649972e71587edb702e55765be3f7ea85d9f5ce495b07b8381b3fd7721dd5db4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5489fce88080d6c0c37a0cd18ebe65f6

SHA1
5ebdc6c187ec3dad5c841d4aa17de35aa005418b

SHA256
b33796694cd39860c044f17fcd91cf02558b35552fb794ae07ca9a5859b122a2

SHA512
233a45ec5a2c56aeb2b2facda923895c4a4c2ac5ea5e7064c4d842c44367cf0f8169f8b3ca7da0cdc4c64d722fa9e879cc0a11212166b783d6e8e0a395a7d8c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6f2268ae7fd3be48dd4d916ed295503

SHA1
4464626eeb7f08487be009a034246f10fc20c188

SHA256
582a9c02527e4cd7ff34fd27b6bda9c05ad437c5a4a3aceb1eab04c2c7a43d71

SHA512
58d101e75a198f7246a30179da304a314685a9430f068b4582b46cc27295238e16f3f72d09eb2a5dc29dd4c8395e175b8c875dbdf3871abe9a1b65e4b7c9590b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
114c9a16c357693826ddad218d5db46d

SHA1
b5d3c9b2ca14f1ce786b0772d56cae009e7453a0

SHA256
86c0935b52e02c8b567a71a184975288c7b2637e3b2b9642b989123af3fe37ec

SHA512
540973ce4798681000efe5f280cf9c28f2868aba10cca3b7e7c0739e747fd0ca6af55c9f0ca199a03ccaa99bc79ef469d8b5c41b37f34e84da616c14f3df0c25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b5d9741f5901dbc976fca7082614942

SHA1
36e03c20d1af7494df3e481674a439e0dcaa7b8d

SHA256
8b5dc791d70e46f239189f2cf720397f318cfc4cb60bc93f3b4ba5c984f9177a

SHA512
aac27b84b7c6470dd88fa7467dd3392f3ffcb4eba9465ffaa6e6166224f0ffb378ae23e73694dedd7a7b19ed2932cda4bb7a57d2aa37fb4e630718fc55355765

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb94623095423e0eea72482b11ce23f2

SHA1
991fb18c841d8fc07a76d8805c3ff2c4a806f07a

SHA256
5c458153bad4ede1bc3659585786210ffc5db491bbc447b67c8bac99663fb5c6

SHA512
8539c3f879523370d36ca021e684042ab75ee4e364a0b0c69950db2c511e69ac432e2429386ed086c9c22f4c7f9560505584850fce63d88b9525c45e00288c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab96A8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar96A7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit