e40909df887d1384de27cf5d4892b9c93e3c6f864e9eafb274a3d6b520ea7411

Analysis

max time kernel
150s
max time network
157s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c1645aae69821c0233f782a35955dbd.html
Size

45KB
MD5

5c1645aae69821c0233f782a35955dbd
SHA1

ed5d9990e93491d704eed40fc2bfb85b7dc57b10
SHA256

e40909df887d1384de27cf5d4892b9c93e3c6f864e9eafb274a3d6b520ea7411
SHA512

d8d4e22240add0d432e0955facfde5107fde1394aaaed4d9513b1c77351b1972e9d79de123a044d05e5bfb1152642c2ebfdd8f9ca840b60acec5a22b5954770f
SSDEEP

768:SCSAs6OqGEVdmKC4qGZ2wQzR8OkmKJZH2JaGRXamidaGnEmehH2csw:SCS96OzEVdmKC4zZ2wQzRPkFZWJRigGG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409839919"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000014329698f8da4b8a4b0b071f970a131f05d0f190588513c399d4efd02efc2180000000000e8000000002000020000000cbbb99c826cdda546fd32632aedfcfc6ef6ce6c1dc9df8cf0ee863c05d728ab52000000051ff8e8b4e66fbe8bd59c094daf50ce8d9c01d42477f8089fd8031ca9823b59e40000000a1fd602c65fcfc1941f8bf506404e0ab47cbdc6a9e4e6f9ba5699a901546b7862fc66b25a3f5afea693b8d380d4ba27c533c83a1ace90e1b62a307dafdd55b34	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20da477abb38da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000da87c04318565fadea33db781e049cfff7ba1e5861514b4d48bec1142cf83505000000000e800000000200002000000008fba0fee5afb1b109630440597628863e9fe3355ed51a2fb760b6d2bf3790119000000041837b28d5d34f2e7971ff6bf56719261c8acf9d8fd7f8ee2a0030407ae284d2942820ce623d2505c1879d086c970617e0b615fc40c97f424221d69ef4c1b9039e895a170358bdcd8b969b4e0f369a37859974cc397887e70da35bde48213fee587ed96d482d9b84c480eb871ddc89cc917cc42cc2b45cc1f72d8295ad00f01e0695fba8a88958ef342755299afc305640000000353862b721abddbce9583fc682dce95038f9c47bc6eb43e383c6ab685fc83427746121e169e6f84819316051ee85b5a233d22fdc9c474aca751d5a319024fe52	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4D55831-A4AE-11EE-82A7-E6629DF8543F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2408	iexplore.exe
2408	iexplore.exe
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2276	2408	iexplore.exe	28
PID 2408 wrote to memory of 2276	2408	iexplore.exe	28
PID 2408 wrote to memory of 2276	2408	iexplore.exe	28
PID 2408 wrote to memory of 2276	2408	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c1645aae69821c0233f782a35955dbd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1954189ace972b281a69de518502209

SHA1
3318bb6bf310e968a2fcca9c63f7ab8f0c6c50ef

SHA256
d13d12b58527e835f57196038aadcbd4c87d833ca55d8081bddbed4b74aa2889

SHA512
2b1c9bbc940937c8a3bc74f267e9e7eadeaeb85ec9375df1abc4d348f9cecdb3169782f45b56ede9acf88f12aa0451365ad15cd45214020fcf1c7d93fb73a34b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db8cf93befbbc1e5edb09738932790dc

SHA1
7578da359972601c875bad8f2149c2d731034cd6

SHA256
d7ac6461a8606540f6eb392076cba62887c1ba8f4667b394271358df68d1e6b5

SHA512
e0994309416e3f7af42e11caed46b98d212b1fe8fc30933e9db6c5bc9fa324ca12fbb5496a1b421867fc077d3b3a58487487e94136c79fcbeba1f1dd250ecd35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5aab700464d75d8b031199b20f92d2e

SHA1
018045058db85eee889da89002cfc095ec7cee95

SHA256
f862aaa0a0619c888a36b8ba0d84a45432a3fb32bc87be3c628bc6e1ddae3f26

SHA512
8ec2533fa06feefc5c99455c8789f046b6fef9377931c02c432e179813a86cdf068e6f3f87b8a6baa08c38fc0e5a304607bb389a2c996a5d9e219623ebb70709

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4364b7b096cf0fb3cee16d0296e63748

SHA1
9de196e51489b9b3a77b1a6af76c947a525efd1c

SHA256
337413214382a31666afdc3962e29ceb42a8faafd85851ad892005527f117971

SHA512
4a7386594e83d858e2f0e6c09743c13d5c4778af8845bab562c0b62e8f2495baedca43c7436a970fd8974fdc53f2367aeb03204fa2ee40186059ecadc4d54dbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
298527283fb8471a2856b4d696223949

SHA1
1adf82ae2d1252a127ab848b5a4f253b0a85a95b

SHA256
6a7a5cacda876cbcc73ad2c0c993df507948de69b2dfc96cf6f0450e493fcae9

SHA512
e01fe920cff363eaf7cc66b6a72ffb87c1526998b326ebdddf6ea5135ddbb9eefa5c978af92fceafc1976bcceabe22da07eececd53d29937177314271bc72f84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9db62e455d9138778c9ef45f905248a2

SHA1
2e4327565c083392eec15ea3beceab3555c0a5a8

SHA256
fe7d2c6ddbfe5562c98fefe049e87a58fd90bf5995fc3c91dd52c5df4c0d5411

SHA512
49aa22f0f3b15ff00d408c2d9994e62596cefc0bcf7da479c608c92eda696dd81013802dcd8a0020e823767183f699a9ca76c6700cf673ead2f4c1f0e3f40878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87f4e1f5ce463bf3ef1644bc20ad2b0c

SHA1
d9b2cdb24b4f333456fa8820399988f5cad92c77

SHA256
6308802cfa66ecab32ff97cbb4f9a7973a9d3e905698d7080d53077eb051985f

SHA512
c59e6fd106673dc1c8261d2f21644d464fd7a01ca5c15ae6013a8e1044799563ec355eee72b451a661e6243ac155ca2b6985b7e9eb6f5bad2176e4676cc596fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5ebedc94d6113a9543c774c2a30ccfc

SHA1
f2659cacaf171088261dbd3b9c3ec6c3aca1616f

SHA256
75978a2b45e43a6549fb160b3aae53b7c72a668f9b6f32d32157a3c4cec9d3b5

SHA512
d007cd05919486a65de69ff3feac3063b6f2765f43717f179493124bcd23c198e74ccf5f413cf78150c6a5bc97c1ba9d26e3d2df63f6b6a0d6b4c9d191f71bd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19871980fa4294b6509e387414ded9f8

SHA1
606ab81957e9fc8d24aec2fe6bf75c3852b1b807

SHA256
9312a85acf21a9739fd5c1a4eb600c579fc31a6b899100947dbf675bf6f8433e

SHA512
3a6bf2f10c1c41d3fae059316f61d2be19546601d3c6a79794b53c701e2467bd9cd3167a3d4d79a8bec33460cb8c5c5b50df908dbc18fac0697a4149ca7f5ceb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2daa0c73bca3ccacada7ac09e6d14e3

SHA1
4557e33a1c9d87ab150fb5e51c5d38db8db26c49

SHA256
427afa2f08df2b01b322fbb22d637076abecdddd9cc25975eb394d628fc2729a

SHA512
fd1f5449bf9793a62a082717ac80954cbc837c3dbcfcc39867308d289c7a04961b075f67fe545aa1298c5fc9fecde3467ac636453b36b049f5c4e95add77a394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0dd9fe30f291635dc41fbadb17213f9

SHA1
91e58390dbc45baf6a85e551a2655b782f73a370

SHA256
31075a2e2155383dc470b8bb10522ffd1b6d093041175f0b3ff833eb42a73956

SHA512
27cf8ba59d93dac3731fbcbc84857dc15960bdfe39d503a117987f20253e24a420d1b72becbaea87858e732e1b30c657653335e22c8c6af80906ac90c433c5e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f1dfa093ba8d1f05fa928cc46f538b4

SHA1
f58c23eb7e38e6c93b0a3a42cf33c22d363c2d5d

SHA256
3383d0888b674a5de9647eda9a475f2c84d2f16d3bd0e79a6415c970b81e4b19

SHA512
221e3390fed00f0f46826d8a478f0cbd842352206e1704007d4126838ae455890e8cc4801140e5d60abe6d0a4c9fa853d7fa3737e998e1b70e3cff7e3510ebe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d2fe72d05bed8f0efe2cec2b850cef4

SHA1
3ac6faabbb8d0915492716fb47b23d24475f1dc5

SHA256
8d69e29077ca519bd0215df6bac278bb3277e6a4ab0dc3b6811788db777257a6

SHA512
793b010cc7c373604bbcec2d084d6271d898118d37099ce5414e14f8b57245a65331798b4e75f22d5c3a4831f769f4bb1afcd7f227d1a467c71648162e65d14f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abe3848858dac7528beb10e0a74dbe60

SHA1
11f516eee4a67f934f0641a167cab986cd00136d

SHA256
8b46414044ed74e16b0edab3b23db15c5a3d64b3db41aacc6c39f85afa6801c8

SHA512
50127575c0805dee45e98cb612dd06b49af225b574716b66abf68ac7d2c4a5e97135c733843d3401a4c6212631afa1a67b14fe69b4c06b07209a2658c7241d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10ff230e8af1fb2f2269c2219eb90894

SHA1
f3c37fee6bb24242c265eab72309f2f199a84622

SHA256
559d8264a3b97137851720687e1d8c4cba430a46b6fe2dde7c609a3ffa2ed678

SHA512
9917378eb84ca864956435c59fd4bceffc5c8e2d5acc553135a203256ba2e2b28b0fb8f7f8c9f69dde40d490574f0a0df16b50a9577593658ab713be5ed3819e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab734D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar73FE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit