e9e849e2ea27e55ca23a79ca838a82c2f73af20506956129b35a8791bf3994bc

Analysis

max time kernel
118s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 05:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5802b2d7c1ab0712464112e097047160.html
Size

6KB
MD5

5802b2d7c1ab0712464112e097047160
SHA1

f1b284ac2a77c5abb61cbb5e386416c7ea553bb7
SHA256

e9e849e2ea27e55ca23a79ca838a82c2f73af20506956129b35a8791bf3994bc
SHA512

b9383e5cf961c88cac8132b845672db5540f7e0f753ff49562787426a2a03afba8636dc76c0f078edf509fd83fef7c89494127197a9aa47f80b74577573d1c54
SSDEEP

96:uzVs+ux7HSfLLY1k9o84d12ef7CSTUiTcY/6/NcEZ7ru7f:csz7HSfAYS/LD4Nb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e012c0c53340da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410661208"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7AD8501-AC26-11EE-943A-F6BE0C79E4FA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000008ad53b7cd96a6c60e09b2810c1ee3c614e6950b75a8911db21d80491289e0252000000000e800000000200002000000057bdd986ebc3fb0827dcb35a057a2de773b19c058d839f0ae8dd7cd0062ab571200000003b26733e531f462d835c53e5f72a5d527613e83fda0c5908280228a44c0b155e40000000848161ed711ef64975818fed2aed621b2ffe43fc5f8b5936d1c6591114faf5ceb23ad09969f7963281e018b7e991f81f1f0792bd13bddd65eb505243d64ee34c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b41d86825944d52a35eac1914d2455002d8e2cf2c1da066b88a47c7933a452fb000000000e8000000002000020000000a5079b3d19c57ffe4f41aaed2387293cc3a784ad4de2840307fdbef182d209079000000062faf27da16a97b363b37098f499f5aacb3d2eabc6a30c9ffc2993c8f9a2868c7dec32cbed7edfb43ffc5e2fcffd7ba32cae601e6aefe62ba498438bf9b8bb5326eb54c1d76c9b2638a869b0f3084bfd9c065f6334344673dfafb782dfaa7e77d89034b1950dc8a5bcf5e9204a60826093c26d5e80f935e1d976fb90b2df4075cafdb7bdf474e8b4b8f948ae7f99796840000000a235d536877299e7b19fda56a294afe078c3e59d6852e161363a35da7cc56f3c87ca6595e118e54747ba3107f6478fa0da432dd0c1e2b0cc4d4e89fca28e3d59	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2812	2360	iexplore.exe	28
PID 2360 wrote to memory of 2812	2360	iexplore.exe	28
PID 2360 wrote to memory of 2812	2360	iexplore.exe	28
PID 2360 wrote to memory of 2812	2360	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5802b2d7c1ab0712464112e097047160.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c8730a5652403e5f8e4dd64d7875ea6

SHA1
2d999b51e14437f958a405df9361c25a31ce407d

SHA256
17c38bb63c9a9c63f52538d78edbb644c73dda1b9175e07f80ccec394314d476

SHA512
214a99a994cb38eb356854f19f9aaf9de373551cca8f7932ba855dc6497c0e38684040ae3ed5d5c2dfc13055c67df7ffacbadb4b4bc13911b9d66420b9e87252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98700a03a7622336d13db0820ad4d981

SHA1
102e1ee429e6805d063451e91035834f66818b8d

SHA256
7fe74d47c9fb079e197b33182e486db7831c0c67575fac6e00fa6665f0c48fac

SHA512
7c5652267854eb24cf1a8c1222704750e1af4db443fdea3094c09a067babe39e0fc2b74ba07f3336eae4feb48dbce3e566e012b43cc9abef4635e81206f14160

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb9d4fab1c313a75781e611c4aad92b0

SHA1
be9b39b2b0e9e9c415aeaad6d338782e23ac0837

SHA256
1624289d5c9664eee6d2daaa253b6740d67bcc4e4462758817284fd3d4f1e0b6

SHA512
9ad58c1e6ec2919c37408bc02f36292a2719b81854af03e3df6f7e0fa8d0cc757b3f9969547d8bc11331df712c3b0324f53b9c26e2a35df47303ce311f341ee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd3d92accf058a13f5df89ceea628f65

SHA1
4f89d40cf22dc0b2ed4a50bc07c52b6e4c59a279

SHA256
a6775dfa88275c2e08e4cb071e3d45bc3df78d3c68b78be33dd35f41a10464b9

SHA512
22b57552bea18b17f4dcf7d1409543eec0cd3c07a5ccbb37ccc25447820626921abafb911f53fd9c1c825c4b5c50f93e7e7d9dd8d8cff0ec4574a94a75b5a4da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f60b73553206c1245d71ff9bd1a9baa

SHA1
845f5fd907af0e16d2f4e35e859720b116b9ec6a

SHA256
a4b33e14620d71a87d5923d1f9e7cf41d59f858c953bfc55fd619060a522fe73

SHA512
36eca993af77297c848a0f053619b051f7e79aa032120f2ab4d37d8d8bb7b0211ad792482e73565cd1027cc45ffbe7ef04554e9b74bd2cc7ffa9edf8d97c6cde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b81eb63ed70419162dc4378c9ba9b592

SHA1
280cf7c1f9eacf65264bbf3e61477e6dd02595be

SHA256
4078b54d8ee76dcab1968829a4fa86ceed64c76980c5b08e508a1eee17a9dd38

SHA512
092878956fa16e623620a6be8f2fc5a5cd26416dac636dea3be19874a72bc8684563361d866b94084432e3e2952a902d3e68c1957b87a0590150227ec1e1b826

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ac0d4ba83234d52ab0d9afcfd1d8ef3

SHA1
2f7609e1bb6ce6fcb37283bf35b6c6d458d5a5ca

SHA256
030f2c57a1b5520998d818a66d014f77e93f4d23d6fa4e7a9bea1b7fd5741695

SHA512
043b522f86f7ad703961c3f2ff827a9c82e506cce3eba0f3006b8beca24412ffd306a9c4f12e151708f7c40012738298c8544d5e78eb1facdd7aa9f8e4ce59e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd9eb8c2aa75387af28d1d528b947ddf

SHA1
73e2fb6b00c82deacd8d31bb7f1f3f48e1d5c298

SHA256
3eaaab97f861993e19761ffad8820ae0ab11d03e4c2d4b990b4f1e6678ee2744

SHA512
ad9b7bf713622a1cdb6da54c732011c3b12a70e854cdeda7ebe5126cf0d2da1f4a6170328425b746e609b6fc41563ab717e73cadd423c3528373811171ca27ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C9F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CD1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit