cfb5cf423d2e498afa4eb04d7a6c4906c8d0749db97ee5386e59a5ec46558d81

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52fb73abc772c22d54236027cbefd07e.html
Size

33KB
MD5

52fb73abc772c22d54236027cbefd07e
SHA1

44b22bd115adfa42fefb157e10d71cbe5fe80755
SHA256

cfb5cf423d2e498afa4eb04d7a6c4906c8d0749db97ee5386e59a5ec46558d81
SHA512

5ae904efd94b9f63a1fe2bfc8cdac8da8deb76cf4d8072ab70bd32b0aa204476bc489c609d227e394559939844abbd8362a908962a540c27f4e4a8d5a440001c
SSDEEP

384:SIzYfxbuUSOqtK9wSqcs1BmGELHim5r1UhhZGYUJmsjZ+qx1A5DBgPt3:SRf50HtBvmGWMLGHUsjKDBgt

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C5379B1-A9B4-11EE-87B1-5E688C03EF37} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000009bc646610f1be6ffb55504ea75685fa4c6357dad7a29a4dea1651e1730c1c455000000000e8000000002000020000000ff8fd3ba3aa1038950ca63ec8ac01a2c3f72feded9662620362b16f7e80cf9a2900000005a0bf8803520508d6f1ecb9d62dc77ecb0f9b6b2cd2963b62119a50172f20ec785a7c68f893df9a0e6315214fd6dfdaafec076d5830822326322f22b95944337deca61423cc5d6ef2b1a7fd51e2ec94c171d9148748bce8caddf178fbb3945a6072d2dbe82a63678cb3efd882e5f815a19ffe1b66ab3d737952489af2b7c053e8f5348f581d8f0c4a6bcb80ff7850bec40000000176b40ef1d97fe6e25a2c842edee991bd81e4d2b8e75f9228182d350a406bc92537553ead85a7b0be8e67848f79f311356473cee5aca40efafd94abb3d26ebc5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000f2d08bc4434d8a74533316ffdeb1ee31048f7f975cc23bd651422444c200cf4c000000000e8000000002000020000000bb3e472e3b33ea9ea049f3c9af39f936f0518a0ec9d70c8c5c45016168f31bce20000000e1af4b026b45c969ab77629be070b4e7d03f0c0da4004832f1225d8213efc679400000005fb4bbab1958980a89940d1a198bcf706a8ab08a974df278d90e14f5aafa8996c95d9d11f1b5f24287335ecf94f1e32d5aae7897367051a407501612ee9e28d1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410392135"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f1373dc13dda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2308	iexplore.exe
2308	iexplore.exe
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1920	2308	iexplore.exe	28
PID 2308 wrote to memory of 1920	2308	iexplore.exe	28
PID 2308 wrote to memory of 1920	2308	iexplore.exe	28
PID 2308 wrote to memory of 1920	2308	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\52fb73abc772c22d54236027cbefd07e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a838cd113b217a45d80b714e2242cd7a

SHA1
d9e67c767e02bf71a89cda8b6829aad4309b3afb

SHA256
4a97bb5ea0a2254c032be783845bc7050ae4bbcaab1bd84340d6c4486fa90ea8

SHA512
dde0757e1add4222d27eb7e3d82078ec4a406c4a722be94bcf40977122671c0784bad6eb8db7ccef3ceee8543fc5cdf26f9b4d5c0921f9d56c7c6b13937b3028

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad254f914d8a3e5afd724dd58744292d

SHA1
e7602a80c51177d701689a571292ae37216e427c

SHA256
3f6949bc4ac2ea4e8c449f719549381b72d275b59fee51f929ee6592b26b7c6a

SHA512
1917b52719bfacf1580401134e40d5156248d949f8c4b46479a005b8c7ea0a1836afffaa49f7f5f71b65319ea352978f09b6076ec04f27de6d6124aedaee8bad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f0f3a3dc167a9a2d08a91f00cc7ec73

SHA1
a295d55f81135e654ead93eb6badb60da1a37dc3

SHA256
6e15579cdc6de76a7cca375a3b171af25d16a0b272f7bb38d3f11dbafe3a81ff

SHA512
d9143cd36f126da6d14a25b7bbb6e31ffcd25f4d03973163a3ddf48715f85ac69a84c63ee29368c98b7b485b4b1db2f71159ac990d04dd41ce0c0e54a1d4c67b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38eae4880baec1187fc3a925aac072f9

SHA1
0343f5e50366d4374ab504a5024125a681f446f3

SHA256
88add4d1bddfe3ed3ede91bc12a64ee537614d22362a53770e12f63e9f6c129f

SHA512
25e09740eada659e4faea6ba8c9c8f9dfe12baedb9a4d096122a571f4f91cc474c1f63a867e62bd4d2bad23b9eef5ec6535103c47d70569ec9dab4c28ce541b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac2e24a80df8fca99f8779084c1d5f17

SHA1
aad92945fdd6ebcfff364086e2f32ff668d1b17d

SHA256
95aeb5fde00bb14af50ce042bf283a340fb455d54decc615b5fdf0cd92cdd4d2

SHA512
6fe2899c765e3f1136c247b6b33c037df3d8c015cc93ad178bc8e45a8ccb50c73629208ed655d60171ca80256fc1046918a995d88a89d870bf3f762519653029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
658955f965783bd28d02206ee22ff0b8

SHA1
b16141eeee3352e4ab2e576ef052203f0c8270f9

SHA256
3aa0f2c3eac96a5e2bfb54e52c8a6ef31b4b6df681f58ce65017c1121f6f49a0

SHA512
7d9530a4e07a209620a091b896b7ca6b1936bb0ada687e68e82f838053c428c35627c7600a0b73d1d6b26949709f0e0bcc36dee9d061007cd4d6ec832f660870

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bba8862e4e6eeff4f87d750067918ca

SHA1
90800d570c33bc7545fa9340001476c266d9ada5

SHA256
2be8f44481933ff98c7fbf73ac4e31fd7f15db51430d21599fc09d092106130d

SHA512
9e1f731a79b09d33ce71f4eeeffb4127bcd358c0cda1b58b61cfb3569aaf7ac8ff36c67fbcc1d1e4430d1149be7f9b2568d6be2ef17419f3dea5b5ac349531bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df66a376af761ba51f06e7fcf1d0416d

SHA1
f9b62965986b2f24b0a105d01763994fd7b184b4

SHA256
b4d24106b7f82299a457741d7286fea7c4c5080bdf0147c5765807cd12214680

SHA512
da2de3b9c657525ebffb66457df4e4b4914f5e9142a56b534708abfca1d143053d5493d9d6c360ea94e9b3d0a51f43db7ab06970b9ddeedf45aa6cda50b303e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff93e2da0880a078454ad4091af24ca7

SHA1
0aa6fdd975ce5a09545466b3b191ce2880e46feb

SHA256
7992088775608dfbd579458a23e74b2c77fa7b47ca1bd8a8149d1ee4c164148f

SHA512
e394b1bb4e6bb91fda69e4a6837aaedb1229c4a65941d1b0f8b603e631425ebb10aba5a49bbee892bb55d5de626045d90cff3cbd3c7647a8f4f0abf17ebd3228

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cea0c403c8a41909a42c85aa24b9701

SHA1
6743a47461a68e50b9ae3e8e6bfb2058f09dc956

SHA256
b9b0d0bac3153cd01b0200104f125baa46776c11d6d47643e9a52a8b9f49accf

SHA512
f83d6218dec06ac92ff4886c22a36c5b73ee4296b2ec62e4982fedda7e568da2f5663c515407d774daa951e0aa75ea2ffe6028e4c22f0e40458cd9b492606b7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ee0bc9a3279ba00b4885e4a74af210b

SHA1
51e10109d9b016e0b15b4e091515cb3698445284

SHA256
62219a2df12640829e0b6f2fb1d633f8af3ae2ec21953e582596da599df3da80

SHA512
3fab7d311f506378f3badf1f423800cd18ffa3580f15843a840f72b7b19a0ec01fad7aec5733580967ebe53ba22eb9f2c05fe99637df549dada400d40ec26e3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a939bda1d06e24a27af00d24387d012

SHA1
eafb43777fb771329cc38b3347f97c6c8d5e6f20

SHA256
d139ae7dcf4d0ca1d2ab7cc9852fc6cb11dcd5afaa0b238df8104964972ddadc

SHA512
ebfb7b1d2f684d0e4d0d448292c349402f8c03660d559d7e0a3246e9297556b6fb081cdd059697b1c85f9fbcde78a5d43c67e50fcb6e73a3c6c23440860fe8c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3F2LH07\ad516503a11cd5ca435acc9bb6523536[2].png

Filesize
616B

MD5
724b88d584bb1376956a465f4a70a718

SHA1
f20aef2e1ddda7cd6350333e0e13824c6c8b3cb1

SHA256
80db3795f590f13868c4b0240b574d998704f74f5560b70bae79ffa5e05a6f6a

SHA512
335c0652316254414bdf39b1512c229b67002930c2b77092dc4a6ebfcc004161f957e02b0fd8020fa8244c2396df626324b2933fadad68b25eaca845b96a99f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\378e9af791783ac18bf592b37719d8b4[1].htm

Filesize
162B

MD5
4f8e702cc244ec5d4de32740c0ecbd97

SHA1
3adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA256
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

SHA512
21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1719.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar171D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit