e00143b5bdd69952baf23372353610fb361a6f04cfde1f7f49323b22d7e8c9e4

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

526bff29043b179f8a07ef13c8514d38.html
Size

53KB
MD5

526bff29043b179f8a07ef13c8514d38
SHA1

ef6d588f6fdc3f8d7d1da581545c7baa5ca7358a
SHA256

e00143b5bdd69952baf23372353610fb361a6f04cfde1f7f49323b22d7e8c9e4
SHA512

e0b0ce265a86692811df0ef43738d9dc33031872251c72f27e76ac5fc50544c0e2b37afd85c927311777a4bd3739a48d1efbdb9638f49d230436accb856cf033
SSDEEP

1536:CkgUiIakTqGivi+PyU+runlYL63Nj+q5VyvR0w2AzTICbbzoA/t9M/dNwIUTDmD8:CkgUiIakTqGivi+PyU+runlYL63Nj+qK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410390165"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000001ce8cc8b7f692789eda5330ad663c7c1bb90974ccba4ee4c6635f0767bcbde00000000000e80000000020000200000003467ffcaef5981fa9c60fc64639b87c92340202e98334cf161626006693b6076900000002b6ad2ea275dcefd0d1212c04c29398dabc67bb266a9bdcca74592fd5885fbdb39e3b29359554cc056df7bbf1374a5b559752637be563a68dc50c136f1cf8d2bc1dd787afd74009b6f4ef9dad18edca04402d6b7fe5227ef7d0fc75b68cfa774426d1f5e7e3eb934871d3b14c4e78ca0e57f4aab8b0244df9002417f413a7b0b65b784ed8a5b54e6f3604e67bc3ef50940000000b8b484382480e545bf8732c77a9b7b8c75e4438536f3df88a0475b696982297ca4aaf12d27696944ce001274118acd191b6b4f89ed79a17fa7cb6d4c9db9e537	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000e570dc37f7ee8109a702f0617a4864680167b9f5ad419358e164967935be8028000000000e8000000002000020000000aeef727587884613a40627fa4165721231ff012e03d2634f1f10fff50069376c20000000a8fdf4718b8385eeaa9769a727da58a2ed8669bf5f1ee304e91d3f3744fdc88140000000918b85d5a19fb420d4827f55eb76b798a070e0f5ac0f1e4a6c30c21fdafd86cfcf42155da52e02d1bc1c89c58865b6fbcdc6911e5d2609ca2e9985fb38de9d9a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0080d2b8bc3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C9A6F0A1-A9AF-11EE-B59C-EE5B2FF970AA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
860	iexplore.exe
860	iexplore.exe
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 1272	860	iexplore.exe	28
PID 860 wrote to memory of 1272	860	iexplore.exe	28
PID 860 wrote to memory of 1272	860	iexplore.exe	28
PID 860 wrote to memory of 1272	860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\526bff29043b179f8a07ef13c8514d38.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e795ff62cc0e2ae570e24f0ae8c8ae7

SHA1
0099d0eae9778010ecf06089a048bdbe8bd803a8

SHA256
ca502ebe59afc83b2dd424e510dca57ca4531a42789aa89998f7711c098ed204

SHA512
a9303de9699be6ecc63a05e7c3ee487b4ed85995afdca2294ee5aee967cbde8a98c43cc442a99fd948ce7f7e4e107f9fe16775f0ea00f39772d2308aeec6098c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40a2aef74a087fb9e617f444e7a18271

SHA1
2363dfe1198ca458c5619efe2d145893f3d78c62

SHA256
7e0d5abd654afe24d7ec77dfae04e42544b40473829f1f0c3c98a4d99a2797ba

SHA512
e39ee64ca235d61d6a2a0cd097b27e784b71dbfe131675a5bb40d6ea4e0d1b9171413493ab88ec1b9d2bda21802435b5ea3fa4abf0ab49e565a7ddb80f10e67d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5744e9d0159d9efa72308ecae364fff

SHA1
143dd7436e6bf81be0ff462d1a49aec386c9894a

SHA256
5ceb69464b97a26c63c8fabae2150629f61e7f05b0655dd1c86eba8a32eb463b

SHA512
44c7794b61c6c818adc72967dd47c93efc6a03ba8c536f2a27b969ee2ec76aa646cdd9be16f3bb2af0eac180bcd1226cb9716dde61b29aefe2c736602e2495b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d07dc5348bb1c2bd4e985050160cab06

SHA1
5fe778f1b0c56545e9a5d0bf19219efb459ad5cf

SHA256
ae271e58e317a5e1da361168e04949288f5426b38e1d3765ad03837c8f12b176

SHA512
b1c22ae1820a06588c77d63c84ecb04c054a43641594dd08fcdf94bd39efcf07a085e8492c58acccc4ffce102f90c5f98f1119688ca55ec4158114dfae76dda1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99b93263e8777d7bcb30b9b6315a5d7b

SHA1
f442a30f2bfdedc3094a467c87b61eeeb07e054f

SHA256
e74c49b7dbfda5216b66cf30c8701c42140af03ac4f34fe350b8e6707883e9dd

SHA512
c4fe3525ea394a892770d43426ec62c1eb8b4354c389b5536ce762149fdf23ea368c25c37a4d9882479c67ddccfafcf295c17144e6ee82ed073d959444b8e9c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c60eb8ea93513d47137727dcd75332cf

SHA1
5baa648cda73826a65c95689e923e162af7b8e6b

SHA256
7d1756b5492f32329ffc7e731cfba33f83bd00ca1b3b613864ba22a1115f4f5d

SHA512
3fc1244dd4da1b9fab391c68568f5f26e8b0e2283794504bb644087b6898d5111b03329462c9bb845149c58f17d41d8ad1c376137e7ce0aaa48b7775644959fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43889f72214072c4b4e207e3b57de070

SHA1
081f3eab44916e7779e6f96ba12088add60a722a

SHA256
9906809e9db85f49316abfb20c95ae54c95759795cf6fb72b51a4bbc9605b73d

SHA512
ae64c5227d3c90daaa82c108c6b83ef7dae98cfc6bf7ec16f5c127a9a59445b3111de5b1119c4c97ca2ba160bce4f4a05c99681b5ec812cbfeca1670356ad332

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cbc970e5d6a89e33e43009aca42f636

SHA1
43b33f809e145b56a0190aaf829a4b06be0e6544

SHA256
30aeba86a915107da78701752884b0a5268c3b5cfd9eae9d8d2ac75af823ecf1

SHA512
d95312cca258f155a1ad86dbc9fd34669ace0dd3b87b9cbd68c535b16b52f46b686fb0a778c3af47e2b08496f10a3d7672bab6e8755f9b9b4545150e6fa23721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
704eacc647fc9ccb254bf280c08c50a8

SHA1
1a57a2f5244f34f7b12cf77eb16352d139f391b4

SHA256
c8ea2f79f576768a6f2172f05f9cd5fae99c63a104da923fceb0628c8853da34

SHA512
027a0b6049848b30bd0e1a9422a5b353246243565e4793f2d8a90d9aae2d5d3d73681b9b10cf81dc79c720e6c0d5a4dc8346b24b62f916941bf75363d000d651

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
184a076fa371ecd5247546f2ea6687f9

SHA1
4dbadf35b3d69d81472dfcf31e561b75fc4d5368

SHA256
7db99dff478e75e748749f8d3869b5af2889b52eea1e24782682f6cca0cff281

SHA512
f867a78a41b1ec16d3f3fbe963d26f3797ea67e049424ccbbe169fcae0b8a2bacb538aa1b2880c20b787ea7f5598cce492e77a999c410ff30f4022eb02759b6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d534417e9be30619ce5d0aded16d80e2

SHA1
3f95aa656ddc80bc7b37ff69fb497c33dd2e80dd

SHA256
020160426f4138c4054d2b778a66a69290b8d7b1b6aae5777d54ac5a0b198dae

SHA512
3bcc0bb80c69dfebc30969a963f963fe67db8bb3a7ad34f45260f48372c4118d063a27acc072f4b155a9e87a4831f96beb28b42a1064844fb1a863bb963b85a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1a6cbace719a3fc4cb23da170f40eb8

SHA1
e3600322d0548666cb99e64a86f1c3f03ed584b9

SHA256
fc549bab23740dbae99376b6f35042e0a381ffc9efa2b0f352f0f1dc021263c6

SHA512
c96333bbb97779266881f4c3737d2ee5e8ab35e19536fc03dc0da133d0d7e219f8d5f2e4c837685f0f9ae55eceea1125fa15672fcb0d780100cf8e3e9280b9f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bdf4ef0a5db53bbc61ce255f408ba7e

SHA1
cae3823befeb7c145b30c41125dc4c9b52357ba3

SHA256
38a996be9f0c040cd8f93a497b0f72d94aeb92b07833c9edb4a698d8c737b6f8

SHA512
7d732565ca2df3fa926cff22992687c71a3ccdd017e7220c0abc73b9284d84371f03756c4eac760d1defd34414fad1f5414c481dd59a672b935afa0ef436c979

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea432cac70db9779aa8bdf7f510bccc0

SHA1
1d68ea9040bad9b6b89a129ccfffcce41a531054

SHA256
5bff17661085d024a3317dabb5929f904ec38a3067e5ed60ee488a3fe96517e7

SHA512
63fc031fcc42f17c5bf532370ef0c7f3c10471bfca8a425c1214a52026190ffa10aca0f112ab18e0f57ce399aaf5fb5bb5c49232a3f7ea08c7b062f0bd3eb40f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d11ae082da201aead3da149ae4fe8553

SHA1
0da3d2cc5d440c522c5ceaafc9caa7756e63cd53

SHA256
0e30772f1845a88ea595b4bdb2cc4aa62e34cdeb83e1f4c1c631f709998c0601

SHA512
25472cdb981df6724a90bea396d883f709c5c852b06e576e6aa290b76d87fde4b903f4ec431f7f606db5f1006734a4769b1b06ed916215a37586a32f93a2f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE1AB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE1AE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit