e327bad4e9b99fd1c2c8babb3d1037ab6fc1733429220a21f4d686370270a7d2

Analysis

max time kernel
143s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

595fd790afaf3ad30bf83c177ca7e42c.html
Size

53KB
MD5

595fd790afaf3ad30bf83c177ca7e42c
SHA1

26069a90f69199bc3d975e76ae3df9f0e288f361
SHA256

e327bad4e9b99fd1c2c8babb3d1037ab6fc1733429220a21f4d686370270a7d2
SHA512

b514536b1c994664f093dc1ab0dd5c78e3884d78fcc98fad7e08c750fc8a2abee2c0fef806c0826fab7bde272f76f68936ad4917189ae67ec8220c7d17001768
SSDEEP

1536:CkgUiIakTqGivi+PyU2runlYr63Nj+q5VyvR0w2AzTICbbyo8/t9M/dNwIUTDmD4:CkgUiIakTqGivi+PyU2runlYr63Nj+q5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c9f2f73c40da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410665164"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ce09c2d3be447316c2558c0baf2a6e010a82da9a95b565f95e437b2591089b63000000000e80000000020000200000002a2004f4c41464c6246fc4154a595be1c0506234e16778ee27d61037017c116920000000721489a51341518f269d1fbc23958288009eb2c16be6f5ff40b261a6bbf336b1400000007f9f5fe63fe1cc0b625c0ddbc07f29d1a99e8dd9c66ba6b34731c1e8b10e68bb963a5bcf2ff3b61b4c4c8880a52f47be948531d05cab7d4c65c603197e754a7c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000007b49f8aff6bde89c63f182a81a23b7c8ded3e8c7c768ebded0ad9d60ca34f25a000000000e8000000002000020000000576f227d37de95c338e280854e56522a166090809d6dbed7b021eae483ad9aba90000000d240cc18607be737b7bf04497f40c8316286238afb670bc8ba940c6d9665585cefa06c1a03f8a0b52458ad39038fbe637ff2621f063e70527fd63d92d75377720a3bea5bb9eaae52fe566caf8a70fe6171f24541c2364d523176368ab9f8f27b4cea48b93e7933095deb8117fe2f2432bd4a7a355dc8ac1e4babb9f87d9c45915b2c4a0a622e61fe7ef2fca50a0f422040000000c0ef1e51370bcff07cd785371669f91f355b70be284fe534f54b6f2764948112a900f4bcfed422845a767e06aa958fcb843c633d6b7e178b5e92304daffe0068	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D7A88F1-AC30-11EE-971F-6E556AB52A45} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2436	2004	iexplore.exe	28
PID 2004 wrote to memory of 2436	2004	iexplore.exe	28
PID 2004 wrote to memory of 2436	2004	iexplore.exe	28
PID 2004 wrote to memory of 2436	2004	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\595fd790afaf3ad30bf83c177ca7e42c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5a6b0007059ac088665876f8786177d

SHA1
ec55d90739bab1b766f0e5fa73f3a19999489ff8

SHA256
0875a708695fd997b5ce0f6b5a69522c96f8ff70189b21f15087cd259f6ee94e

SHA512
6bad128f2facda7456591d123ae27da8652488d44031a9e3ec55c542c4f9827c045274e40c4ee65dd9a6525adca554e9eec17d4a4ff430a3ab6a35e24928f081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
273589762fed7b5211069d0ccbcac525

SHA1
e46a2837abc8e625117224cb1e8d27f91150911e

SHA256
cf800802f254d8d6435a002b9407bd1950f97ff5867d2b017cb452b652f13209

SHA512
52548558a9de5f092d718cc6f8aaed904cee3326142c6a4a60f1f7dc49727df20103cf41521fe18fb97105b19a35fafa254c81cd860de4079cb6e48bbbb7bc6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0f0632176a48dc92c866d8795bfbda9

SHA1
ba2a05991f2b83c8e200d6972a9a728689fe4c67

SHA256
7ec7aa7ed76343b3c20d5b0c89f04148ba040b6d817459dbb4b9091fd407d171

SHA512
29c79eec1296aa634b3c2b1945f9833973936312d5cad10835e511e1b6e1f83def80e043d106803100be2bb2dd54f12f9473d4b1a59b62a1e80b8d1adb9ed917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e1f04b2d417ba13b3bf7da446341ce6

SHA1
0eccd1d3196ccf07f12c7aee0674d329cf806a25

SHA256
9e9aef4cd309139391192729ef9eee65f81f30d5724d382fa7c20eed62fb56d9

SHA512
f4f45fa327a312f990658ac16093d89fdaaaf93448c347b708ecf6506ad7879827a09359ffd527c93694b218257ee1e0d9cdcf54a300396051adadad92118466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df5033399089b2542444fedaf1868a53

SHA1
7eda29ebd8ad07aecefeae9248f4ca21b0b298e9

SHA256
b3696bb17175d87676fb1ef967ca6e7a9aa12b232644a8b374d255d79cf44573

SHA512
5bdf6f3ef8f3df772d94ec1780240824db47219b80c3b6ea95eef0f768b7f5a20361d5e41b74e1c9ba69ead004890bd7eaebc33f495dd2e914b005794cab2c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fb4ed19ffe8b80bc9e6d67368d4d6d3

SHA1
04db41cf19b580d3ec8712d758b956b26dc454f7

SHA256
267af6f512a08e20cfe130fbaad77599c58ee65d6aa9c8b129175b4488593cb0

SHA512
6df3ef9127b82920552293a874e33d6a3fbe6a30294d23b36b0b9350de7700f6468fb1ecd9f160677fa2881eac27137b5a860e5c7b103534d690ea504d53b0f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99f74c9e9d20283deac3d73fde6bf00b

SHA1
73ca5ef2abfa059a9a85f6f63b05c599449b5b66

SHA256
1af02aea7e60ca0082ae63afab3584c4b43ecf7fbeb788904d5df3339d1794f5

SHA512
00f969d81e8f42de426067b1e23114e5a5f07ae02ed184fb747d09bb1e7713df34f2174c3d1fe81c79796acf0056532d29bee29bf5aa480896f4bd3535b57631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c8890bb465994d880a14902f17b05e1

SHA1
ba52a6c5e0a3580d6c37a8146d4015963c6ad563

SHA256
87abf7678257969abab02121c8579e99f09b26a5207f2f98973793cfa0c7dc32

SHA512
9a11c5c8b18a6334a4bfde505b4b1edcf3a733d2243dcffbf480a3e72de01601382129da28c398141a0373456a987344c61477b9bbb17ad7b914b2811cd6ff97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27c6b20121c69516720f12287843bfac

SHA1
6edc86aa87f3a0887ddfb18d42e6aa996ebe06a7

SHA256
51a87f11be51e5adeb6b57df7db156482bac3a01e38ec47e3c23c1defc7d038a

SHA512
be1600344a92c0be597a551b6a18a8458d6ab8fcdcca2d110a8227ccc2b054bb400636388d2bfb02d94a8148f7b14c4bcbb24df6a51e0bfb8d8a7b2ae899ddb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
844edbfc76fb945fac8b76f7be5c7406

SHA1
90ca69ad06993a5d77ce0f24bb5a9f6febc13b44

SHA256
bbee8b6ba218fae088e090f8d7aa20483bab80148d32e618e9b7125fed251b52

SHA512
1ee6152fc2e53ccacd0ad31419a13cad64f26123ede9933e68254d50acf2c0415e2b3e285ee712927556648c1f9ac9d6a8692558a4aa59d93d5b146be5d80088

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c1527b7669f6ba1a593212526eed7f0

SHA1
19ca8c46e0a82888b9114935993075673f58c527

SHA256
d55ac9112a764c61ed85ead7f46cd7b29d253400c8b6138a5a59fc93ccebb471

SHA512
dfec6665fb565a861fb0d5f50a7db55d4270482fb62c4d642d2fce42310f66ff96f1ddec4c6258068f45255609351a04e72c93c2fe26cc3f8fe5e1aebb0653b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab89B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8AE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit