e9ad2218bcbf178c6f43ffc5f05b4b5b332c81a09d25df0162ff7fcfccd57869

Analysis

max time kernel
148s
max time network
227s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

598352f4335d03a58bf7aefa20b8c4fb.html
Size

9KB
MD5

598352f4335d03a58bf7aefa20b8c4fb
SHA1

ffe81c5190d89b719c9825e91bd13951ee541646
SHA256

e9ad2218bcbf178c6f43ffc5f05b4b5b332c81a09d25df0162ff7fcfccd57869
SHA512

fde36c51c88e96391533aaf60f7f3501876941499035efe0e59b97f0318d6d97f71508958535657d4ce9fc048d18928d57c43108c846a2e65a7bdf052534a5cd
SSDEEP

96:uzVs+ux7lrWLLY1k9o84d12ef7CSTUqGT/kPsUR9pUlVHcEZ7ru7f:csz7lrWAYS/PfRvUPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ec73f03e40da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410666026"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000038865a5cb59f3dd588d80f57c2912745c987547145016d177c2e44bf237072b0000000000e8000000002000020000000547a62ff3421cd97879d79ab084924bbd4eabf5d3aa45d049349df648f104cc920000000134fef089cf9a1130c8fcc2e93a35e02887d9d45bc13220ff65193de4001701c400000004f09293f19cae62e036029b529034f3008d3e922df957d82ed76f54cc146bfc6dab66a71177cd88340797d838845a7c45c647a2ed712648fd70a1eead2da6152	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000cec9ec2d7468279bd1a8701ee802ab6e56373a3622e071892ba352026fc1715a000000000e8000000002000020000000d813abdd82cfa39cb7fd9e1ed828a739959bcecf1c6e8c3422e8efecfe45d18c90000000cd719a85bae482ea8a12792d0ba171ba2a958c2bd9d224a22719cf35c82c4cda0ecda0391ac446dc45c38be0c4e9bbd1b9a3b2e6f32d25fb10f8971134cd871a058160bc8c86b6ae11c30c1784d36d41691378486f66348106834af144df65c37d7092eefd52562c53be7b04915c4a92ea061af3220aba668ee294c9d0abff079e4854f5ad1636fcca6f309ca0822f0b400000008d419191cc7dedbf978b20c3702d284224b5b3a2b3b8864432896008e2307e45dc41dc5b5260f19925a2cdf998256da35a757655f7340adbd1440d895f2aadd0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0ABCCE00-AC32-11EE-9F40-4A7F2EE8F0A9} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2624	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2624	iexplore.exe
2624	iexplore.exe
268	IEXPLORE.EXE
268	IEXPLORE.EXE
268	IEXPLORE.EXE
268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 268	2624	iexplore.exe	30
PID 2624 wrote to memory of 268	2624	iexplore.exe	30
PID 2624 wrote to memory of 268	2624	iexplore.exe	30
PID 2624 wrote to memory of 268	2624	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\598352f4335d03a58bf7aefa20b8c4fb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2624 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45025826be6924f0705dfa5e4b77650f

SHA1
0723ddfe8690a9c0e8ea49647f059e948bfadf48

SHA256
c4b15873669542c2faaadecb2fe02ca26492c1dac1ba19bbd5c6bea3802cce51

SHA512
680c9f56b675f75c2cc77ecb10b4b68b8f1016cc953b00d17c9ed1f92f766302615d7fea7adc88901bf9072b47224f628e5662eae471176f3ce98f3daffee3c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8eb5c5d9bb04af45574f0a6cb1db70c3

SHA1
78d0ee72643f092623e239be526036381f8925ba

SHA256
09cd95ef2fff09b8803607ccc5781032af1de36d60060401c99f0dc0c52eb46b

SHA512
d6bd9f1e278401d526e9fc4456ce5daa49e158d1a601a026a30f6365e5851c7fd322ba3e486558c95818d5aac6a1a7a4165f3392743f7818821f3b6eace801ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ae6e554eb1544e648b4c4623c1be3f9

SHA1
ef1013c9b6a01d7279bc1aa2b9acec8b4b2a49e5

SHA256
9997a0241cb14d3965c039ffedac4418941a6ac963434847c1dd9013e659cd14

SHA512
ccae5801241fa94ba3e8abcb81fbd95956628b19253a96066d5a324e063b92caf4f02f20475bd46c6f65e8677a51352df43a6ef3c0c967793430435d15ef01e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f704f4104cfeeef53c2d4dda16294fa

SHA1
70331e69fd59e19b2d83607bfe2764174a64dc06

SHA256
7e85e878d02ad6cf6df7f4cf1096c169daf1bc54e03090d013be3c3ea7c9e0af

SHA512
b02c915f4b8c0dc7a36b9cf298f25b51581fc7b78127c3c6d2a2778485aad771d399bc0e02a20fa7dafa2585fbdcfd889a727c16fd4d452c2a5a7a763a74e78b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b26dc79e6200197281537613af85211

SHA1
9ea59658699a6da75dc1c817a1762fe8255e893b

SHA256
96b06d4cbd299b0af1d2b3efbf6464e6c8d53d33935e235b97269a621c5eeac5

SHA512
4a82faf049b94ba30d6f37d24190a8a765de9b96368a8b1802c75c0100f80acc7bf3afea405904da2670cb8b4762b327ede15d639218d2f3a31dd5061037ee18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be77f8bbcbb601353ca7d9de9a4ff7e2

SHA1
baf9845a3905355b202e768f0384f44d10345692

SHA256
a07efb3436c08912798e075ba4909de2f1b2743b53f0b72f7564394f43bee230

SHA512
6a1358415e967500475abb129a84578fb9e07196da2d06acf71696a58b2c144bd214243276aff5b9348a13f15cf5ed23fb3aa3e94648634ab93b126b43433764

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cb505dc5ad68f3798b507cb903e5500

SHA1
e7005f572f8ca4cfa96e4ad3e2b5f5ea613e3d63

SHA256
a57c1863b5489b08c1db1458b757b4c131a01f1418559dcc99cd9f72ffc01e68

SHA512
04d5dec10786a7fa279cba37fa2a567dc02e43b80767ab762bbe86ced1c26f15413c1aecc21a571ca2a3012ba6bfdc0abdeeb10b7c09323585f636291a2f09c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9b78f0ddbe6525c7291e03f4da94f21

SHA1
5361730af17c87b08cb12e45c3843496a5235ce0

SHA256
b582bcc2aa7fafa229d0d26724ca8b8fc7487b241722f9b90959c4f58186b577

SHA512
b7d143489f69848a024f5b707bc7ba77169c5a405ab05d124275e8cf70f128fc5f279e656159fefe21f109fe43950a67a2b242278b0af57527e52df032c23989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
143851f227c928392e50b4cef23f482d

SHA1
f2b25f9cedbbcee4b5fb777ac639ce51afdad653

SHA256
c689832ba5d05a819bfbbae12dc0fa06539f2a54864edc74dc179e7ea2d149da

SHA512
443bf6e709dca91bdc3a3c52b915cdf599b70320c062200d98826148d1d3f78a72392bdadc2a6e00d286cd3560df96f5189a21aa9ba59304c6ef6d345b102e2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77572b92b0875773d8d0f0083e1c073b

SHA1
5ca12605c8c37297907370838fadf3025a827bdd

SHA256
cb85f44d4f77ba6030241358fb78914757b657156a3114ef60671edf82ce3c9c

SHA512
6de837d83e5f5da848d5a247909fbb39e69e1e1a0ccfac2cedc9288a7da4c56fc40991bc1d64e41c0e06353829d6739f8101d0be740cba02efdc8ee0fc6b25aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f8f4669ad983ffc695149a9eb29ed61

SHA1
3e9ff45955f5183b10d54c519e9ddfdab82cd695

SHA256
375cf9aefc0a2cf1eef60170ed9e31ea564984d19545a4afbe08df895d42c272

SHA512
3a6be68ad331ca45410509c0662d8c83cb002c8ff24fdf87591d9f8fab730ef20dae470393507beeb422d889a7c8b08e32cb42f03e3f35542c95dcfd54dded60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7d4f55f2b5b045d7f11004ac0fbfc16

SHA1
4a304d1fcf04fbde2ea2440c229e0c2bc175db1f

SHA256
e5aa3b80174f8b1e49b09e9e09e6020074ef7291c1bf06435e98d1be9d95f1ad

SHA512
d80adf461f63530c12cf762f722c21b0cfd2d823680e1115fc5acb3b0b9426bfe077b1a592b7f86ada7ad79070857b9282ea188adb60ba0065e01790963767e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55b4557dfbe9205c8e94c3b40c76a22d

SHA1
cbd474daf3d62c925368759b614b13e541ba3efa

SHA256
386622d8a24db48156920941fe41ac34f19751daf154cb71ddb4f57268767974

SHA512
ae61884eb1f09f260b5c3063e92616b6256bc44f354cad5bb8be43877f02a8e4e6536a85b3b55e6afa0e885f4c3757af058b42d94b4477c8e68959622fc2d0f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4236e8756f73e8061092cc4e24003977

SHA1
bdd7899d23615e50cc959802f8414969c39070d1

SHA256
110780e6f8c1c5c5d6a7a2fde5652f49d1ea64655de31e50613a5cb1017aaf56

SHA512
1d5ac583dfc5a3c05e06f6f70ad54b21aaf608bcbce2356eec7aaba0d1d7d1ce26edf8ba58ad806982ba65c74522966f2f5193593877a46ef8fb9af10835fbce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a3f54a60d8f95d69d300075ece26e4e

SHA1
56adce8747f000186bca45cfd299e947bc45e10e

SHA256
faea6df07503af2977d42186aa5b2d7d6657361d6656ce9bc8ad3393a9d5c732

SHA512
0456a139155bc0f55c27e33c94790c75e4cebae3a78d23e1a1005bdf19e3efa180fd7d21218c912a8805fc852d85bc9b23521dc9a4cffd1b1a2c7e37511083a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5CB3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E1D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit