e02545f350509d68c110439d83d15ac409ef0797af5b108edf863a8d68dbb123

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5393ca17d1500fef4726fcd20d7cd02d.html
Size

53KB
MD5

5393ca17d1500fef4726fcd20d7cd02d
SHA1

38aa28ff57c33a5dcd8a0ea05e626539ab4490f5
SHA256

e02545f350509d68c110439d83d15ac409ef0797af5b108edf863a8d68dbb123
SHA512

8c3c89942084d57b9382f7e586eeadfca47ac3f1410a1dace495105ecdbeb1fb17b1a60421b11cefab4451c32067884f712b0d9ba6c6017da914127da876af19
SSDEEP

1536:9kgUiIakTqGivi+PyUQrunlYV63Nj+q5VyvR0w2AzTICbbso+/t9M/dNwIUTDmDy:9kgUiIakTqGivi+PyUQrunlYV63Nj+qP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410394140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000033566b3bc2ec7e96fdaf383e1790884aa394a8630c825355e4851174de1bffe9000000000e800000000200002000000043b9ce6b24891866f270729156386b053491c5fbd4acb7ce360f5dde55d2bc78200000005641f7471e14b6428b304c2d54badf5e7dcb8b60ccd3af4895d05bb31b84d3f140000000f9cc07f1deda979f9c0c036e3c4d6046662c72dc98d72d3decd25ab6b7c093ad5cf52c172c54b88cbda30b4812b474e64890f85e08454d46a7110b345170c0dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60345aebc53dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD707BA1-A9B8-11EE-AEE7-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000004a3a4403c6430bca6d0ea672b9e21c0839a9ea5e35e901c23fdf711b7ea48660000000000e80000000020000200000008842208d3e1b73a458ba326518b0b5acfcc3e6373fdb70e5dcd4aff736cbec3b900000005a19a5fa1ce36d6142569b37aaf077afe9b0fd008903a08c0221c5b49591ab14b05c3fd87efdeabc0208c2c8bb5bd5663852d41cef2b2b311e30e06810ecfdd98099de984c52599f2bca4e690c7f147683a2f65208f105cb615f974b1261c800acc2df6b65fce7af77cc75205586061dda1670ee20a79d0e049e8ce2686d8e145e0e49b35c0b756bc6e8593705a20ed140000000997e3bc8023d9b9c4c0df9570abd2b50116a848dbfad99a5b37ebbab6381c6626196672d3e36944c084df902aee69f0a31d350f9987af739f3f972a62f62903c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2292	2140	iexplore.exe	28
PID 2140 wrote to memory of 2292	2140	iexplore.exe	28
PID 2140 wrote to memory of 2292	2140	iexplore.exe	28
PID 2140 wrote to memory of 2292	2140	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5393ca17d1500fef4726fcd20d7cd02d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18910c64bd148ed6f241cf356fc50d2b

SHA1
f93b789b11a01da2a5802bff099abef7ec76d5c1

SHA256
388a6e674fa5e15b8cb5f92211e9adf0cf59bb1a6fd4fd234f727106aed95bec

SHA512
79cc40b642f894cb8d2e8323c01394147269963833aefbea7a062afd8c63d1700dd45433d5e6dfa8de8c5b24ca1f7a2577047ee1354c69d5aa9ca047ece8ad8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6595288e09bbb889fff7ac8cad6461f

SHA1
3d20752ad8314efbb8e2f6f1197ed0fc84b296e2

SHA256
4416539c45dc925643334228b053195ca7f9c3ace4b78f567d3dbd4a6363a90f

SHA512
97eb44db029e9d5a7ed9ebbf019ae5d3d7b3ae832ea961d0e9a89e7480324aa610abf3987326bc45436317db2e1686730e0b5452c1a2070fcc48b30261261464

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43efa02ade64409a4d159008e1f27d3e

SHA1
4ac1ed5cb6393cc638ca831115e6bf4d2d0ad018

SHA256
004bc1aac747eeea833f73f47002bf06726d28aa7f6b2a0ebec880f488c159b1

SHA512
867313f6dad23e10402ebc37ece46eb64841d225b5ba3eda654f02e4d4b5778b4ef7a67023d70e35f0afb58ea26e8ce72b388a94f8a51f5bbab1e28a518d694e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25a8d6a5e22e1d87939a35fe745595fa

SHA1
7eb609ee5d7bd8c007890fd4a371772aca176519

SHA256
1a47486561fb6cb781437dd8bc2ffb4db0f6a547454a990fdc577d835395c5a2

SHA512
f888847bc514d6cfccc89ea9a52edab3b2581bf0a873d1d22d8537fab472856a7ffcae587cdaf5c6e2aaffd6b5dc08f09b49733858b07b51906f406c26275cda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f63c7da082244efb242a8a0599c1bef9

SHA1
5d28c01a455b081da2a710d04c47d772a8a48d3b

SHA256
d549e612180ebdbf59fc8b6b65019641feff6e6277638010bf055331ba3bfa0f

SHA512
eb6db07274a57639704e8552be544ba0f2904f8325aaf194dd5b6ef3d3431a0917d225c48d2d5856d23d592dc115e69351e0e327de7000e20af3b2cb2dd41230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1f7a7be96adedd65fd0e0602b4cacb8

SHA1
20234cce7d9221599da3fc7423aa37576abc7f64

SHA256
24552ba1a774730bc3bd02ec5b3cc1cbda5123d22eae812179ecd48aa33201ea

SHA512
a8d1888bffc84e2c7f888597fb781e95f4bc418e593417aa78a57471a9c2ff15153bcc30eed48b6a682311fd558194c9536c7fd3a7d401e7b8af82f214a685a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
394bc7e005e57fad2d46ddc6e3d93f39

SHA1
ebbe45b8d211cf5ac5319811fbac128a5ab39dae

SHA256
432184da4977da3616b8f2ea027a14021342ec53f40ff92f341f17b938cd9874

SHA512
cc102dae95a6d3da622cb7bd5015580e9d935e59314f5b53c84a7ebf8c84a7145a81d07fce860b6e0eec04d69a56ce212e92b075f5394ee3e1e61458643fd64d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9140096ba9a312ed36ad1072c8196582

SHA1
612a93b32eebafad5daa91dade7fafb038ba1a4b

SHA256
ff2a1a92678f519b2e64d5dc37045b3157ac77767cda6eb68d98d5902835eed7

SHA512
ddf757274a60d489ca8a572eb819ddf2f3601542d9af6e4ca85afd0791f9e16c4796600cf8715b4a61b100469e02496d2fecf949bb48bf3ef1b66a849c6bc7f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9819508e388fcd49d53d3de2a494e20

SHA1
e0bad8d38c0bdcbf397b5592b1a4bed0e918b009

SHA256
f4ba6c22677b4a7bf1c0b08215ad1b80cc22bd7a6107218229418eda28912cf4

SHA512
34e5078857eada322345d11d0cc9d114f00a393a54a01475155a046c43d2d4f34d7e4c715c60e91a9ac579519ab003a1e54c17d4be84e2207e6b68add5ca42a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b94df8c36519943547772a829c4f15b

SHA1
760b47274b5787d05870c25a16ee59a53cf24a28

SHA256
24a1673b078fd131a3b5d5b9dadb563e778b845d3d86da92484372e9504424c5

SHA512
25123ea884aec21cc8d657bc8e3cfcf2322320c764782f2374af323fc5365d358369ab3b3518538928d5592b2efc5e4cd9c885923e8edd3a4ba7deab2a25f32f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82ec52b5f4dadebe66c774f2fd8f18f5

SHA1
527fbcfb99e5af2c119f20de5c84ff93b68af422

SHA256
8c40ce2ec957199f81bf89d2e9d1e05d4b2b7992b8536978bd40ef25c451e456

SHA512
673718353529668dd0121e0a03e8caa7c5cb3b2e88fdef1cdb66641806238c2af3fc27e63dd01210941740cfa34705ee405189a854daf77cfe73e791709c7cb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b476bb57af78fced08c6b58b4bb3414

SHA1
6f42da686e2c40e54249c9f9c22d687fe326f593

SHA256
e1ff5405f6f2b89bcb057d00339392cb9241048cb75fa27ab2aa2fb7955e13d7

SHA512
f3d376fa473f23da5b9fe961b78b77a526195326dd92f94ae5bb9c35ce7bda8c075e106b88f2aace55a4cee49e0bcc25b1f59cf3581431d465a7a4e20cf41845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3d84322be5c2f37b88e5ea8c58fbef6

SHA1
7effd57c658df869efd352aefeca23f6c5eaf7af

SHA256
6d288f58d81de1678ccabae1fb3540650015de9fc22c2cadb3ff0631b870f48e

SHA512
a8badf3690a085bf386c500e82a6cda852a9274e61f007572e88916824804d9c628ef3382d24192100a0e49f579f52ceaad8b331204ded4200d3497ddc9cc545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\print[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2ABA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar30A8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit