e5be6c10f719dbc5f504a2f60f8e8637899b3c3384c7a79a3585c3d4d0100679

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5838e153eda4f63f22718b8eff9b8bf9.html
Size

40KB
MD5

5838e153eda4f63f22718b8eff9b8bf9
SHA1

2368b773ac512b23430df27964a4b18aa0dc5c82
SHA256

e5be6c10f719dbc5f504a2f60f8e8637899b3c3384c7a79a3585c3d4d0100679
SHA512

cb6e636a38fbac9c9559507c3f6cb1cb2a37e559474397b57b2f4e118152a12a463d4ed90524ed98d324e18d475a88457dd97007531c1a2172d436f4b6a3903d
SSDEEP

384:SIuHJ8Tu/msCyp4bq5/CyZnNr2b+4TTip2yeHip2SXr9+isU8c:S3+ilNJ4T96Ngc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A06DB871-A49D-11EE-9F2E-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000098ea5ce77607523b07474d99dbd23e647d05f55297d31fa71243b7d067838067000000000e8000000002000020000000ca74baa07e314504ceb49d5643c871d3701c287074e75987f4cc16e8aacbe22a900000001e06a54fde4e1ef1823b07bbfa799bf1e96c010b27e3e24cf43c8bbeff61e0401cc3cf7b56dba626bf7926cc43ce551e3f4ca5dec19bc6a11ab1de00f1856f6094d1c4c9bd07b5574d762657332c261644f0675a40893d2b17045ec597e8cc72532d90382bca1b3bf0d7fe202804ea9a099d06cc7396eec9211eee4d6e5684736ba04f3636cdad74423e403c72fdb136400000003f51f0a59f724a074fe9dd147e60b44385b039ac9418ec41aed9e7be3cf2017914d0a5d3237c5d6ef4749fc551e6fc8581ba749db3c2d438983b6dc08b7e30b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000080eaf41dbfeb831a03bc756b86c96d2fee5f9f7d4cfd666ef3d05285e892a516000000000e8000000002000020000000c7308b7e551545bbeb5e63b7741394a651b8bc5e8457a76a6a9a74366f0dedb820000000b48c6c25c17b7796c1c9d770425705f7872cb6e48fdd3967444b17120d0782ab400000008e90530616823b11f71f7fefc1937098e003736c6d084d0b14c249cc406a2adf83f8de98830bab15e3dc00c125428e6c1fc0762fa55ac0c007ab084a6d4533e7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05bdf83aa38da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409832612"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1644	iexplore.exe
1644	iexplore.exe
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2848	1644	iexplore.exe	28
PID 1644 wrote to memory of 2848	1644	iexplore.exe	28
PID 1644 wrote to memory of 2848	1644	iexplore.exe	28
PID 1644 wrote to memory of 2848	1644	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5838e153eda4f63f22718b8eff9b8bf9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1644 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44da7d29cceb7f4d3507de22c860a105

SHA1
f5f00207dbc23096dd35c07b2958db2219a9f0e0

SHA256
22a87b4c181e5786918aee3681ac99b3284839aed4a07a097691905f8e502fe3

SHA512
5d47f68f07230cffcebc6a96e7633e63195a98cbbe7050d1d4d675633fdb41874428bca6637c046f563b93666d846bbaecfa098d450c1a8dddb6e993512f2575

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78a2db4f469e1efdde18ccd703c30923

SHA1
8013f7a87e57f2b82f4db3f7120a8d4b238701a1

SHA256
cd67adc02b760038375aaace4e1848418bdf835dc61bfb4922a1a8b172865033

SHA512
e6cc59e3606c122fd82019eaaf07b0feac70a419a3bd111ea8d6f69cc961b704cfd0cc94089809b01e6022e4f8084212772375da78a48c8627c93051dd978f5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdc81a3d9bf83e71c4455531bea94787

SHA1
23cdc9c9cadc4bf1f44a1e848b3c52a1bc89bc91

SHA256
f6ca2cbbcf173476df4f274ebb0e29d31ed865bddbd67a014ba753809defd182

SHA512
0ff1113f65b1f352f38e570d8320a6f4990224cfae62852a3a6a0dafadd77066def30ab2b072c487376d60d9658a8ab59a7525054e496365f507c249a535e19c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e975cdc8352697ed18d333bdf006ec13

SHA1
5a628a17183aa0b89ff842bcf5575e458e3c10ac

SHA256
5a23791f0920e164082f34ed1cfb9444ba237f557825e41208d491eab346111e

SHA512
9cd5f07e6e69d2f75a3f9f61c890227ed25bbfa35003e34ce9a6422b78c39f14460e2239d898c07cb7606f03ed21c173f9e4240887b7a06a4536b72e45834cff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68d308316b09d423eaa368bd7b1bb256

SHA1
c0b5be603236a0282ba08e864bd9f39f0fdf1b9e

SHA256
afd65f7adde3fc30a1584a27fea1040dd0bf60d019c73cde4cf4e3a041694ca6

SHA512
dd8adf858d5f08ec61cb8dd2dc9b2c8fcb872047b936e715f7ad978c692227effbd2ea55d12793e09ab68945da32b42757d1cb66c3172b39701ac90201ed114f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13715d9508cdb0e3e0f0bacdfb82c60d

SHA1
731d1b32ee936d7db01357d59a122ebd02e6b95e

SHA256
5a2d8bd80b77f8e5fd5957d4901b9663e3b44cf562cdc7bbae9d3fbe544accc9

SHA512
fac805d2a250d983323c670821d307253e78fddc444096189a7d33602c8621f1c16846c04af35a04c50df3e352ecd047ff8e07605fb36bf62f0363e24926b029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
595c55cb308c78e8c9fc3ffd416dc754

SHA1
f1987f92ee70e77233b4504e1fce254debb8e26a

SHA256
b9000e4e7665356d8b7a001209024963e5688100160d8e8e5b58f55d0a8e5a27

SHA512
3f65673cabc455f316dca4307995c31b67392693ef5c92208d4da07a0f984c349fab725a9c4f7cd0f4287734a38f9ada1a3e0c39e9571aedd6f941fd56165af0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
235644ece8503eae814cd7102e52675d

SHA1
38a936df0157f0a6a68eea6f02fa027e8c49c9ad

SHA256
ad7018e105f9f270fbf7210286aeea82d878383cf12c0bb942da6d57bd21570b

SHA512
509362e7e8eab78da8c25f1bd4f1b739e4f4ca45c7fda1a496f69eee531f1d674b9fe37f9d5861590da323019e808803de7c0c92c30af4a15fd649117b4cf9d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3901c488c6c9f7c1608ac58643b5c82

SHA1
e5b964f0639b6dee91516c696fa30a7d09ca0679

SHA256
c5052b07c6526716d204a82d3049093417033a78b6c66c6829444843d984d0ba

SHA512
bb18d4f0143464e5498edfa227609b94c95005d0afe169fa4a65bbafd902f6c3e0e3d17e6d4a0c5ffb50bba2016b1e33898f2b7c0721e108efcb36ccbbf4ddc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5aac63124665d0e61fddff84a147a86e

SHA1
279738512f171ecc5692e58067a8a7926cad2302

SHA256
a657a2922f99432ff25246bc2c789aa384ede5526fb47bb631fa8492dd9df33f

SHA512
c56bb038e492ffaa8d35bd6451c173e10661cc7c2847ec3752bf837cc5d4a30c7b14ec5c36994f1d0a2e92d4634259a713fcac6a88ca80dd5730e03fe2ad88e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26aa65e42b1a7c1a9d75ed407bc4fcff

SHA1
5fe33375faae96d5b9b6e1ab2b2b5336d98a738f

SHA256
8b16cc23d446b94062bd7831214703a303aca601e1744e4094a252699b6a4418

SHA512
f220f765dd031678c85c0d32cf7ad84d3a0f01f6dac1216c1b7af5bc68e5920e96b088e1b6cfa6ad5728c8e7492c1122b0211db51942bcab37b353bb80e926be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98eab3ad38eb182772f8fd88e59a7cef

SHA1
8b7c268c39c59eda3215631ea04f57892b4c3501

SHA256
811a0625ef9c67dd7576243de4720f467735a7ec66021d1bdddc86724790e0b3

SHA512
6e2683c09a4ae45b22c46dafdfff9d03551c7c30ca48106ecde1eba83da282d6c111828ef0ff271e9dbaa270f52d3261ba8049d340511d1133383e6c48847704

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D5E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E0D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit