f5f7441caba31ae14df4494ee1ce98cd396991699235e5158620a7f81b482efc

Analysis

max time kernel
91s
max time network
175s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5501b95ccb07765070457025c45aab73.html
Size

28KB
MD5

5501b95ccb07765070457025c45aab73
SHA1

4d6528c36c519bebf0bdb577f54d46e9eeae2f3c
SHA256

f5f7441caba31ae14df4494ee1ce98cd396991699235e5158620a7f81b482efc
SHA512

b9205a2b0cec9f70f4a659c36b0e94fc63168bc24c7c51358154a1dfc2ff7dc59f8c7e7e1c6da81d840c16cf3daf63a89d3c3a2d6c63c3e3ead9b6fa7e379885
SSDEEP

384:kBOvuXmzg8M/Por+PZsgeFNqogu3kPuT3fL:kBOvSSqoQZsgWkPuTvL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d1ce2327e41858f196facd6b3ffaae394fdccb738f7b66ac68246557eef21419000000000e80000000020000200000007c345de1efc7061e857913bf15a4a7044b87e0da6db9bf0ea1ecb35593e4631f9000000011d83b5ba6cc883547aa0f1d287137345ef3f7cf912bf5a3c76fa37a62be110de4d7717c5f76f1aeaf8c55f6ba47a96512b28993bc963ab58cb0643949cb5cae08bc62a231e569dd9afb4e32c111c5103cbfefbc08f25e362e0885ad351cc020a7b3630ed403457eb554d2a090d0213f018cf37e38e97e636d57a5bb8ab2c264b6c70f3c88e97c77417ccc10591e52fe40000000e106f4b085435715358a751cb8be0ee9b56843045aa750e7f1aa551c1cc671ab1e5572e911c9b083a021bdeabb13589c96ae8e3f69f3516397058935fae0c399	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ec4b26d13dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d7e05684484a11937d995f400afad6f59b291e87237633032f95292a083bee0e000000000e8000000002000020000000d5a599814d1c438e6f993c90f221d1b0cfa87e430990b4571dd4e93c5533d29f20000000569dd2f61f818fbb68a82e5215d9232698e541ea51d8e672f484e52cf15ff16840000000f6856f531851558c64b7bd00d34325e6e09b60bcad4705a3ed548f8798a07fe6f3c45b60cf86a115a954dc9ed642ffefea4fe656599f44e4d9cbb880d0b7ac58	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32D54591-A9C4-11EE-AB16-D6882E0F4692} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410398942"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2284	iexplore.exe
2284	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2712	2284	iexplore.exe	28
PID 2284 wrote to memory of 2712	2284	iexplore.exe	28
PID 2284 wrote to memory of 2712	2284	iexplore.exe	28
PID 2284 wrote to memory of 2712	2284	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5501b95ccb07765070457025c45aab73.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cbf7535925c99f4eecd0f51aa644fe0

SHA1
d27f96ecc3bc09687af1e3041dba805e93d2e1ca

SHA256
59edd1045f31e3a377dd951fdce7ec123f1a7416bbee35010f5ab18279ff76f7

SHA512
3f77ade668a722d2f23ed960f486508392da3bc4943f272e32ee562aaf8bc1d027011ebef7d3eda2b341f82ea25fa03dc32e11a1ab76d81156300330c805e894

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10baec96bde5df81f1aff4f2114e3df5

SHA1
812e782c6a9a794a49cf455dac968d4ffc19dc1a

SHA256
c13abdacf9c5109a0443bb4415289bf0a93a9df654080837146aceaefa17ab2d

SHA512
ab6bfd4cfa7af07de0bf366ace40475eb10a623a11024a9f82fc4ae2c101cb0c0960612d7b71abee35cdd1fed541eecd9f4db26f8958200b0a279ce50e3c0fbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf2199c0bf700d5647a92a9379a697d6

SHA1
32a21251fc50196129370ef83cab3b8802841ce6

SHA256
118f6c5b5aac5300f8b9e26182daab459d6f754d2e21621640a325bf5653a5a7

SHA512
1a39a4dfb2c9a20de092b4b3b672d58e3e961816e9f9de19774b006ea93ee8a6e2d4a4eb75719780c0f069f721e414976e7f88222ccb149a601a7c300b3acfe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5099af1f7442a66027d846aab57ebce

SHA1
0a67d86d08c177809822fb3a4ef9240f80256a31

SHA256
462a6abff55839bab1dc869a5a4cbd527834ef372c4a329af8eb5c722072d7fc

SHA512
acd9a8cfe4d962180171c74d94adcc8ed4d72b4c830542d820c3ed3618fb931880219e694b40e1b79020c31f0cfc5429cfc0171cc23cb13f7156570d9bfa4410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9574d2e2d1aba11acf706574150abc9a

SHA1
5ab023970d59bddbc95f0571f774af5addc24feb

SHA256
075a55060dc4c57c710c647a41100018897703e7d1809bddbaedeca5e6065b56

SHA512
398d05f2b8a51c1bf17ea917176b2a57d638695c41c0d923c5ea2521e7a390b0ebc3e26a94c12aaa45e9327206089717c8eed5c59906a4bd86aca227420d5231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8895c220353b3561a2c5074b330ec2f6

SHA1
ab4dba7cc38c81e1d3b81b7b9b965abfdff2667e

SHA256
14c3ce256daf2eacc46d136c8ecaa44f5e05dda8827dfbf3fbbda6264c53a727

SHA512
f8940ab0ca017727492338c925bcf62482399245a83165f46eafff4829b39abb8adc37f77baea1db86de643488b1c58d9adcbbf51b8d709b26809e0dc8e981de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c07227fb36c8ee00e576d096de6b727a

SHA1
dce3b9e6c48e925275e1685b1385b6f9077b5538

SHA256
a12f7bb89bdc70540ebce2cdc45dd4d2d880cd51733274e2f577bc73b0c793d0

SHA512
cb51bd144720171cefb36e7d38189a7c7794588738f59ffaf711f60d8386ae61edc7861a57a3b9a4ca4c7c4f8f36d09e8fe9a2a00929b2db881757c11ec865db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f555165b3cb26be2050a0fffe7168ebf

SHA1
a8b8c4be1bc0f3f0e1f04bdf5af0317267943f5c

SHA256
63046469915c11663a3a5846f31fb09dba45acf6b81c8b984d33110b0cb9aacf

SHA512
6a480a9f97df9c5aae12e526197ba8edb12afcc7bf31feb3850d95e33c51117617f31133862b7055a290559f2db5c2ad6ab5923718b6e0a603674c4f25be621a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4646bb10d62dec728ccf04f476ec35bd

SHA1
c7e06f68e359c74b3c7ea4a9a798484db4866d04

SHA256
9f6fda1c7fb2dd9f586cfd5eda847549c240850d8ad98f430be69e4f15486030

SHA512
a54668b222a4eab034294728e721457eab146d11764418362480c49a6e472113564695c073f423203608ebe91f1e714a499fdb89da910a3570c3f82e7750ce8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
181062b860ecd09f49205627b315feea

SHA1
175e644d141bce78ef51e9dc2b6599d99898a271

SHA256
5299cde3fcb92b2c89888572a8a688de070a23366a8dbbf5f8760bb40f7b245b

SHA512
a21d2f28e6658c4f388d9dbef9684de4c75a0d37de190f66aa5f9b3e4da030171560db3bdfa6bfc49f7d374c7528c626fa2854c7b0ee3127f2914d93e4ba3692

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1891d86b965d53d01ae971195a40c21e

SHA1
9251651fd84472a418c8e0fa70ed215222e04845

SHA256
1d60b2e0dbdfc93f36b3a0a06fa58f4fbeb40d3460acd2a41f569ca3b0d507fe

SHA512
0c3eac551cd3625a59385578f845f3b1f9c5476bea9917a863a0f2b9863fcd1b6393216452c41d2c66c7a03d868106bbbda18bfc064ae96a66b99f0c31f378fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29c4a27fa78371284c423c63d68906c2

SHA1
c6c6fd554f99ee910fb8e64ee76982ec2c48eeae

SHA256
edcafb30f430fbb6d20b047745c27c2489e893dc145f3fd0bd36865fb1549cd3

SHA512
6dde35251cf210ccd8488e676dc73f1af63d3900a9076ed3cf0da51f03b94a4fdca0a3262d9af12c839e785251fc582cc6406feec64fe0c476250d8accd0c51d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1032b93572988c4f9120522d1072fc91

SHA1
6453090875e2c0dce0dc016aa959556e93683896

SHA256
d534b41949a89fcf69ad8d285064c9d81d4e4dbe18260cc54be98674eccd180b

SHA512
0ef496b1d4fa7e4696d49544293c161167a9415acce0bd2569005339ee73d859b209b5c0788ee338c192be443d4f8d87ac4b0ee185debc08cfa376d199556913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\f[1].txt

Filesize
34KB

MD5
177f413f34f6226df1a1d91d2958ea4a

SHA1
0f70736bd5035ce5f3ac9d3cfd65299cd92d35f9

SHA256
71c78f0184044c0b81f320c30cbc41136049f84b951901edf9c36ac9949a3d5d

SHA512
a2348d8193fc1a5fc76322956d9ed7925fa7af7e0aeb5c43a7151fc9974b3b5af7d815486551864b9404db36611433b70d4e7f3f5876420ffa7254840b4f050f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC91A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC9E8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit