918620adc9a6ce6c4931ed447d340e375f51a1eec556c41528d98920b3f5a3e3

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

51d0b882af7f41dec142326697d53b54.html
Size

1.1MB
MD5

51d0b882af7f41dec142326697d53b54
SHA1

75a74ced2534a50e5ff4c60cf72c84405cd88629
SHA256

918620adc9a6ce6c4931ed447d340e375f51a1eec556c41528d98920b3f5a3e3
SHA512

8ad4985491b458ba0e0e8d1aa77b00434d8819e4900355d40003afa8ebe7783a4ee8ce48648eea091187b552145ebdbd0109b7e584011c71ce5ec77048c3068d
SSDEEP

6144:hdWAdb8RIB7QpHaQSuaWypEHjv0RnZ8TzOxZr8Y+:hMMB8B1b2mO1+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409822169"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6005c7229238da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000e933ad16ff28236bef2c86507a25788bd5b2feeddb28fa9b332cdbe80115b0d2000000000e800000000200002000000097dcf753bfd6db5d30f1aa35d1fd10d59ab982ef149f4bdc5882c43e0adc3949200000003e99717f9ddba8fd72e25647c133ecdc2152ad3721c5ab4617246c4095974d1c4000000060ee8aa33b2e8d7aeca7b1f7962e0bc5e2ed747b2bc60d48c68f995bfd72af81fd9e08ec639ea78db7a0a73bebbab56f7453e37d665f50589146b4cb776879a3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000723b423d72c64c89a64fe52f13916afb17347a6fa8d4e809cd1e2b3012c3371f000000000e8000000002000020000000a68be897d2dbf0986a6e19dd168b06cfe8e6c9b47603692452a9dfb12270e5a89000000062b0b733db74b0f15acc1cc4338d610585fc98cbdff64ad490d8acda0dfcad7c1a27b05986f90274537ca33d29d4a2e7b6c2398921278b542f80dda2ddb433b05d1b11836ba644af42fa1548325aa8712b9f559f6dd4666f33fef55566f5b769e6bfa04321413606e2a117c3f24004af973d91fe09be8ecd5e61aa896304696818bd7ee46c2a36243585d05ab4feb7ed400000003120c16a9ca441c4e47d0965b0bb7daccc6f1c6b7d87a8ad9fad7673ebcb5bf95cb3c083c18caf5ceab4adc03886a7803e77212fc2ee0ba9b64437e869b352e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DF8FEB1-A485-11EE-AD67-62DD1C0ECF51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3008	iexplore.exe
3008	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2248	3008	iexplore.exe	28
PID 3008 wrote to memory of 2248	3008	iexplore.exe	28
PID 3008 wrote to memory of 2248	3008	iexplore.exe	28
PID 3008 wrote to memory of 2248	3008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\51d0b882af7f41dec142326697d53b54.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcaaf7a4a8d830a66b5c8c4578076ff6

SHA1
ccc11a4098df3650d63c58931870320e82ae72ba

SHA256
75a2d13dfe357d20fa432c95dda1f391e480fa3ca00e0cc2b3c1cfbb0cf47f8c

SHA512
82ffd3df456854b8a02198482fbc75bbde3567075c9735c839e66ce3dfc609f1974d3f3e5fe8c3dfd34d31c1a137d84f3b67cbaa18e7cf603f8d3bf1ce0cf1a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7691527fe17c77f1ac2fe737e003d3d

SHA1
6bcfc2a7a68aa7012b67d8792b5528c3ab3c566d

SHA256
101abebacbc05562704a36d79eba97d7752a7485c00e8a5c69030839fffaaa70

SHA512
8b751bcdc6fbf0ad3b0afa3d1658e9c121e487b858aff15558f1a6dbbd2b565a528d74cd3806d22495352f16098fe5f4e2fd45ac2e77e99f6ab5577b4aea6eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4493b364efbcfa633a08d089891256a

SHA1
13143c03146680f0e70d0edcbb5cb4c5cf8c64cc

SHA256
644c631aab22e95ceede071264caa73805bac336d181a99a51951882c9f81982

SHA512
d6d8f677f3daa655cd2cc6a756a5d7540f96dfe094033a01c45b95bd253d395c46cb0d57101ce94ffc34cc2ab2aec040ef1b1a2cb0923d0e9f67db298533c363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cc6cd455e1ea831abaa5f2ca3be1375

SHA1
cc3d6ecbeb649936aa3237c7e7cbb189e0ab77e7

SHA256
c8971b7b83ddf310fe16053d76f55bb6e68af253cb9f39e1938cebdf6333da29

SHA512
bbd41d129a715248c477f03d5e5c306b54cb7ff083e09f22de6bb1d78b6be0c11247cb40d17ff59d9035cb793b872a77a168a7f82bd9191d1fe29ac1d0fa98f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea44fb7f0183282421d63e4f9a475888

SHA1
67e144c51062f17e87248af549f2e139cd2684f4

SHA256
e55d9470432ca36d6dee48faa108172074c78f414b7088dc8f875a9b208ee36f

SHA512
4a385bb432f9146a3f32982a65d0e3be825f4ff4c8b519a74ca9bc43614239ae9387c75b50b697bead7461fcc0712808346415754d2e083592c0b19feb0346bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0071e0f914765c641271f40ea691c65

SHA1
f723ceb10b4658b8bda608eee740aa040ea129a3

SHA256
a3ed83fa602b9e197d019d8d0512a44f18d4c61ef51f85f0543ed589bbbaf6bb

SHA512
33a34d68a369143092551fcd1918ef13cc6df8f5fe06cf82ed48f8140af91ec73f7c19c7d6c74a7f94447bbbfe43bfa2c75795379e0cbcfb72cbfa6102a5a7a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b4151acb0b6db3a672b5b1642b26a9f

SHA1
2360177573762498f5610074e1edaea4a919e7a0

SHA256
7b21736e6d2ce236ab5312a38570ad9f60590b927dbcd33711c96b2791d3985e

SHA512
67b5f2fe7356bd3211a5ebd6b0438e4fe3d60bd1ad63c92370100cdf51348d51fc1e27592690602ccbaea5b089471c51784f8e18bc4739093c4187cd4de64c0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65c747dadd3ce919aedc3e3c58858884

SHA1
d6fd5c746e2ef9f358e02aaa7ad5bcc10b7fcc41

SHA256
8d079102d04cc6e6a269772e5ffbb9b2195ca4ec9fab4bad6aa7540dd773dab6

SHA512
7d6004cddcbdc606f6e1c7c90302f657dc075c8cd45bd2a21550365f6c00927c5e65e5e8c73e98d78cf4a0575691c67dd89fd70a196b663d2437e047942a791d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3d88456f3303464ea85fcf0816c61a0

SHA1
34b00a4bd9697339dc0647d2cf34aa19f2caaa18

SHA256
e8329c2698d17aa0043568d0e05e69051cd5eb7bd1a381493e4abe4a5e6bb62e

SHA512
ca95708e39493c7d1f3576274be8de2ccf4f2638440c14ec1c494b7c7cd86c78e88adc2bd387e968ab413aaf150f70f508b0a69ac4f259237c02ea6c5cc2fb1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf0b82978783f16293cfddfe147007b4

SHA1
51da68537b23594e8dba76aa1d30cd9be66a58bd

SHA256
a425f8a8a15428aa100b56a21f0b94689a7810e279177f721144e04182a5ff5b

SHA512
2a930bd89efa32ffc7fee355a546787b4d54da0a4af38fb76ab003b055bed0d10876c51942773abb9acf92a2f2b12b983f2668c3739e6d82f6ad7230ad27ec40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c67c93e9c4e1ba9d6f5479697c74f237

SHA1
e5e73caf7ddb778f2b79398e4e864ce55f1d4512

SHA256
321438ef2284a6fc184af56c4eaebe43d215c0062768cd508df76f332e13deb4

SHA512
9fe40783228234f4d7fe5e0ac93200b244412dca1c5b6f2436c643ff507ae97cf77c26bbde88ab811a135eec14a9740b04927396006709f7ba8fe09c8fcdb34b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d37c67c2d98f63b60cd1b8bd2dc8da82

SHA1
d47d022660f675fd398386f5eaf81fe869a1351d

SHA256
747abab507c634b38cabcd78945b55925a10e5f1f7ed8d7b798e1279f4fba8d5

SHA512
23b4f786e70fd4b31dd1c0051a1066dc96f521d7d74b35ba5ba95c0c402cebcc59525e2d1c010efc6919f553092e35790bedc6bde7205712d6fac70f874cac58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0184d302b38a6bd0411ffc0b99b02537

SHA1
c54a7d4574125932ddeb52e2f786a37c2844c1bc

SHA256
812068b28534f7ec6cc87c208bd5f6a8b561d45e732b3c04b2f035106df95ea1

SHA512
75ded580f0ea2d3fd3c8ce0014c2cfc3dacb25ccd159910c08e9af221b5b10e2b7162fd6868b46259a89eaabb538421b11a8d8383cbef6786db39c157521c0c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa0e5a7de9540c964a133870df4acb2a

SHA1
2184c744d2ddc6117b1ef5c2c8aa54c18d283e2f

SHA256
bc9d6c2d7b1c66ee1bc84c730e993eb2cc61fc9f1269b241f12b3de37e38176f

SHA512
31d32a6fdf0aef301674162f0ac3660c203c66a8b4957a61c3e55bb469410661f30c674f22ef4c67f3cbcad59c72da1929942ef0e41d99b5b5df188fb9107ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8dfa3a52809ccd95be3243365d1570a

SHA1
361c2dc773fdf6b28161a86fda7407d11a59fd04

SHA256
e669fe89b5b8321fcc75179bcd0e1382b69bd46f6a3e2728cb6cbe3c72b8b0fa

SHA512
1d85034d0a53415210dff920b65692fe7ea5a5b6c21b4dddc2bdb6dec73a5d7de0164d1f6949d49123b6579889b7152aa24c8ab11a97ca39813ce6ce9f66c89d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF855.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar42C.tmp

Filesize
92KB

MD5
71e4ce8b3a1b89f335a6936bbdafce4c

SHA1
6e0d450eb5f316a9924b3e58445b26bfb727001e

SHA256
a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5

SHA512
b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7

Download Submit