ce30367c63bd6eba8e5ab4ce088b9ca2cd882dab1d7842660433cf3d4e85ba8b

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5783173c1f97181bb19233daa25d04da.html
Size

74KB
MD5

5783173c1f97181bb19233daa25d04da
SHA1

9486c5fc77b26ca217db58fedd3886d08b38beb2
SHA256

ce30367c63bd6eba8e5ab4ce088b9ca2cd882dab1d7842660433cf3d4e85ba8b
SHA512

d294cff2bc66474c7f7c2db888fad05d13ee7384fb964527ac6c08021e20f727ea67378942f3cbaf57bce0053dedb61dafc67410e100fc99467d60efdcb314f3
SSDEEP

768:F9C5TlIYktB8dBB8dDtMWRbJjH8dhPoRzKfbJil8dx:9YqQPQuWNJjcdpdx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c032b2ff2f40da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410659618"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000008ac313034f1cd737a5d6438423d3f8591d2aa6cc5553d8557b456ff9a04668a2000000000e8000000002000020000000ddc82dad6131b7c4d892b3cbdf487488a6134e5e4a82e492081e860f543f9831900000002c219dd8100f30611dace4beee8b5336f732dd4584d8b5374d4d3b43158f1ddc0d5301aecd05a1971918422976830d05e360e935807b83ac2de7b2d7a68146604a093707e575d8b83cbd68c98f26004db0fabcc9b2ff027b65f73ba25f7f1339a5f4d468e7ba3c7a6e1d97fb2da5c815712fea859800a4cef17b245ad708ab5e5880c0bc6e951d7a31a287aba4935c084000000070ec986365c80a0ea0c968e5083f546248a18bb40fafb8a6f58ba27e73e84559a6f98205e6dbb51eac21efd426a32a780d092dde3ed7512a488cac5381c8c068	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e13c76ef027bf420747eb3defc38b43c8ea61c55e809dbac6f3db01c7f47a064000000000e80000000020000200000003c7b7dac5350a49f5eaabe54b1c6fd2432d5b3a750d0c2469585b797b890522120000000c2e3b6c134af7ebeeca35cb01f5b7ce6ed658e9fd3c0b808ad291b83004136e5400000004b7abbced03d59839eb789d9a072bc54fc24c52c173fe402b613aaa66ad064eba5237bfce76a73f55f3962104a2b80f2a203804345b49c5408da4b2cdbe3a67b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26D5A301-AC23-11EE-88F9-76B33C18F4CF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2840	2220	iexplore.exe	28
PID 2220 wrote to memory of 2840	2220	iexplore.exe	28
PID 2220 wrote to memory of 2840	2220	iexplore.exe	28
PID 2220 wrote to memory of 2840	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5783173c1f97181bb19233daa25d04da.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4479c87733bea098fe9bf4729f5909e0

SHA1
80f00e2a9e6b637071660503515858e51dff5aaf

SHA256
9f850b34d981f7383af7417a5648c3d431f80818e75ccd77ac9ad54d33ee3601

SHA512
352af3341b745037efc9dcefad94bffe5558bd08d61785d72a722ec3572ab4342b892640d6c3b17c98fd368fdf6618479bd9bc3c2009d90f6ed71308d7e5baaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d618217230ac19e94ea149c44ef7c80b

SHA1
c4f77f6c55bcbac6aef4640727c8f52e6a9079c8

SHA256
75027dd7b065f5a99bd13bad65c4f6b39dffaac9510d9492a5ed7d63459d4eb3

SHA512
52b3027fbb87089950864e600f2204eb520cec3cbd5c5e180ee3579f89b47a5f7355e8962f82199c697ed85a83afdb3427c3f3bfd1238a0f90873f71e537e2f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ad947e068647537ad585b156519c547

SHA1
8e534ab2e64b5f3afcec3ed15998630ff585f6c2

SHA256
8e81a3b062073e25d207ee7c941093ccb7e714b20dbc07a35f81becbbd4392e4

SHA512
3f1480dd5512d7587b396a508f331a08bba6b2d85c0f5404be7c3f40a78c029329dea8c3abca5edb5d5b75b9b29e10d2ffc078d6ad699aa026bb886068cb6c00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0818b13932dcb14041aa08dca898e8b

SHA1
51db6878080b528220dca171d63fba16dc76875d

SHA256
793895eb483919482bcf0ec063bb2e7db2b293bb163e4aa445eedc889fae7390

SHA512
b2882cd935ada0ae81048da48f4e8e16b483679f26310fb415da0e2184c739c8d5a9444356641af13c6268af66249ee3e3a968c85e26c3d3632cbc4b6cc46057

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9b72bf34ba89ad6b99770ff14eb9644

SHA1
635d868386250be38af505bb960e4faf5ce8f1cb

SHA256
98c5800691f2e97e91a4d4a3998d35c4c83413cba7595f904e975d8afeb48820

SHA512
ff2329acb27dad381c85ff20e1736b3a8604f6abdd896a1ddb150c509401c240a76006fe32e6cbdc8486a33c92a346e3b41a4bc1b9e120226f24973939b3e98a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01dcb221c95f67beb2dd3c36fc10ef82

SHA1
2a0eca4eeddb1b2000d38dbfdd3382d724409ba6

SHA256
380995c9299f58d47216f67eb042277365a95db7f924b1cd275dfbf47dd2a263

SHA512
4649946bc00262bcb975e1ed4918923f9bb8de86a99e0328d2dca0e14ca832ade8be9840609a4c942b95b34aa30099ca3fe3898cdbec2b07d3763d15876d487b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bdd91cf6d0a0437f6f30e04c1ba34a8

SHA1
3af023574588a40c5f014f7ecea8057c4e278b30

SHA256
643ee1b0850823a9f9cda84865c5147f93474d15625d4973a29cd2991d01558c

SHA512
e55fe6bb5c3e0b8c261857e9cf4efa7a01d3506159dd4fb4653c9334fb866cbb2c339b2acafc5e8ed7d126537a4704dd9e3fdef9ba7a7b5fd1301ff619309f9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63949b28c86cd698e28e7f3dd6eabd2f

SHA1
2003da26baf858b105f0852983c0f89549ce487e

SHA256
2962969879e9bc10bae348223d7a84cda356587d77ba02696bb04bb8781af0b0

SHA512
2803f3d541b5f0926393cd8c63d63eda74f23f347f3f6fc5c7f2e38a82015b2608a12f91d1eada151b44daaf568f3b0cd34b187241e669a57df8284d4564bff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93df733ad667acf313a5ca44b094b537

SHA1
3d4262dca48c066c074b7d3d632ab8815432095d

SHA256
f89f6a5b271b26f23099c7a6a4e841965b04fdf72d922e5bd35f42944b062aaa

SHA512
4cad46fbf53ec7a9b5c23ac94135178d700ce9c300a11c8dd5fe88561ca3e3375b2ae6afb631a027335af9ea879a9304d039d2b3cce34be16cf058d3ba793670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fbf93a21bd737de4d169e56241a962c

SHA1
dbc179ca803247e01537814800257b7f7b09f8b8

SHA256
b1099e54685461cc189dacc0aeeca27f09c8a448700ef2a3cc710dc42e133fa8

SHA512
538f8531c2607dd6829a53e50d7d4784f5504ab2dd4ea570b0479b2a93058804106d9b95dee0f9929acd4fecef945464c720d5f647c303603535f9ab663f001c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5999a5a763d7ee215111ab499198d350

SHA1
82d413bf36b887984578998fa6db2326aa02a36c

SHA256
0cec5c688956f0e0c560df13f0c350827c597f9c67ccf0bdfb6ff7343c2988b1

SHA512
12d5836b7ad7c05917cf29e663a395eaaa09e4966a175f0f22ee6fbc39a8de09994919ca88900946e4270f25c32c452d9cd9c20f8691c9e4dbda9099372633ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3cedb2b7e29a2810edc82879f255eb2

SHA1
b35335c4267ae40d4ad3208c2504e1a1bdeee096

SHA256
87f2aff0dbc664bfa2154b5ac847a4a825845891482791ec5eb7984f44ccf152

SHA512
1b3496f08172329faeec5c864c52d3fe4cbfd6ce7e296d35ccd84874190443e4544ec7fe72aaf3369143cb378806c30973a4ef550f50dd7e655082e2593a6901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0552d88921477c1be0cc691cce83b3f7

SHA1
5520f816786721236fbf2f86789c657a4d0fe218

SHA256
6cee657386c651d23067d6f8293564f4e60ac6a1a804f8bc2c8e361476aa8bdd

SHA512
b5504af24f1000437f4ab3f8ac9417d113ea011346d05d914749c122479fd3323e438bf19dcd26cf1da265c53d09db791ca38d4c13a39ddd3755eea95c3e6c5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95b5df50e0cb2ac6c280733cd9359275

SHA1
1047dcbef35e9aabfd1d76450e6590837797d76c

SHA256
f9c26a32d289751931c8ad62978f4c74466eb835a7c8cafded1a7c397ec67600

SHA512
7136fc740153511a284311922ae628499502b24a08137fe2e4b12b9ef7b87515837319445d5960b37fa9870d6a393fa17769ce78de91d21ea32e69c14d3cf572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0fde68ccf529479f67b48603217cce7

SHA1
b83a3831b0efefbb6f080be73998d6d190b8e7a6

SHA256
49302050394ef7a7be80200548226e05e18e144e8176827c9b924086b08cc1db

SHA512
afad8f3a1ac81bb6639971575a3040ddeedcc5984e100d47352e381934548bf2b7849198bb20461aac998ec259bf6e5048efbf9c3f30f3fd694932c9344c930c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCFA1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD040.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit