e2f0e071b2c3b5585d4a3e9fd635f2a9f1774668bbcdba134b2d1ca61032b85d

Analysis

max time kernel
66s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c07f03ff63399d0a06efb82e2fd161e.html
Size

9KB
MD5

5c07f03ff63399d0a06efb82e2fd161e
SHA1

b323526902bda14cf9e817960aa0a3bece3d5235
SHA256

e2f0e071b2c3b5585d4a3e9fd635f2a9f1774668bbcdba134b2d1ca61032b85d
SHA512

bc1703eed58ba7ea80a03c02de3e3de79f16768c351bcac213062bf9656c2cb2629bbc319adfa52977861344370011b7e518d5ff9f6434a9e7f8d8b57e01d3af
SSDEEP

192:E9rmu2XAbUKc7FgkuO2T7Zkt1UsLj7ALvp6pzpgOp2SpNxpzp+apTpzpTprpjpjc:ZXKc7OkuOia07gBxxpRhxphxR5xhR5hC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305145095040da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C756731-AC43-11EE-B59C-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000ab22643a49e3dcc07598fee06d3ae36fff8d4589e34a83270906ea1ab2f7d40f000000000e8000000002000020000000d3db900c1789da62dcf223e573d7a30384b40bdd5b4826f5a1eef18a81bd9e03200000003103c2ce4ebbc0bda72fd094cbbf06fae400b6b2a1c5bded464233605ecd6d9f400000009e56769ca50c42f0df0d8805472c00403115ff429279c77855ab725defe060254ad3856ea5c1b66c90ca56aa5dd9c65d417bbb86d45c9c42b03784b7da819026	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000e8b734669911b013458291ea47d78257caeadc90a2e7245e19b411cf1ab3d448000000000e8000000002000020000000da8fd9c6d40ec1533ab7aab1567c62009bb627673108204b02a58cec493da70a90000000c3ddc4a01a0597558defb0f21542e71a793928249c43c39e1411e3e9e6628e5ab49a94d5d71b5dc5f7c038ddb33344cb3fcf5fbd891c21c3637b2c1c495a19c157365b851a9c5ac7ba243ac383b613385e760953c6c44df55c3db62c53e4aa12db2dd7137b4afe28ac75d593e53aec71d7ab77106d7845f927172c0043dd9d200030ddf9904efcb947165bad330d922b40000000d2d85427ce53f2787e6cadbedfa26d4c00df51dde6657186a2a5909e002bbed8e470f858311b8f2e201f43fbde78239b5cd425063aee41ddf93e52503210f7b1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2884	2104	iexplore.exe	16
PID 2104 wrote to memory of 2884	2104	iexplore.exe	16
PID 2104 wrote to memory of 2884	2104	iexplore.exe	16
PID 2104 wrote to memory of 2884	2104	iexplore.exe	16

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2884

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c07f03ff63399d0a06efb82e2fd161e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c33acff2ea8e052bca05b4b60d70d14

SHA1
580c9abc1b5ff93ec642d9c61635a3c0621d5886

SHA256
53b7703aa3f1ca8948d442d465e47f88b227e7223cec321ca288b730c4b3094c

SHA512
09838fe772a0dc1e6596128913feec6ca0ccb555c4c4673a8351b39cd34dbfbf36bef52da948c1fd50ea584cb44b5b304c474fa4073ec61435025f5b1e5e7fd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3d91e45288e0ad4d2a737824fa942bc

SHA1
4fcd52db43044f012325750f3640e4d5fe673651

SHA256
bce54ea91a74047304a8e29a3f97266af582b799c0401a9e020c2caa13aaf974

SHA512
c31d82198f08d1866affb2132ec095d79c3eaa793567a3e95c0086c196a725769dc642556e7f7db9c8c35818e44f0f3b9594acf7c220716658bfefdb8c7a9cdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
373a3f2ce3b59ff06f2fbdb76b2fb407

SHA1
ba452ae8a98571f6f4734814c20e563b427133bc

SHA256
caab960e863a59c4f90c1a29fe7dfd389799b98786eb00941f022ab20117aa76

SHA512
7552f26f8a91a7974fd2d5e47a931caaf13d112d862f89d4905880c980bf6cfafb0b6892879b1906e0e844ec95ea84eeeaa9f6a256718a0647e7b6fa2631b8f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e1856de25653de636adbe4064929b26

SHA1
57d3434882105e1a33cb0ff20d56e9892b7020e5

SHA256
dc72f79a53d86a3f3e0940fccffe7bfbe0435f6c703ce7adc3e68ffd9144f01a

SHA512
3fdb0c729f1962a261dc07fc4f181f3243065e1c96e8e32cca2634b2301b6e429b014523afc8908fd97b4792ed56401b5352cc7190b908ff8dc5cd746bf26f60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f5a280ed9512d36b37487cbcd2614d3

SHA1
9d9f13f8f9461253de708b21c11d1d1ff92be033

SHA256
a7f43b645df43ef9bd68edfae8021dc8e8440f31fcec9f791d3f5416480270b0

SHA512
aea107d50b4bd0fe3aad842aa20d680cc0f98e226ff06de32cf2443fb53330c99e32a34672945da164ee60cf6686d37ecfe6275be2df8fa7823ab44157e5fc16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d13654ccc3151d70012f446c814132e

SHA1
a35fe512d746a39f5ff1b087e0cc14ee0e9af26d

SHA256
f2fb19b56fa7d2d061d7f5a2b882abefd72ef9b1e3d07d966459109fcef879d7

SHA512
7f23f98f2f8cc8b30b4392ad88cdac5d7f3658f7deb260fce33e636a5de3b471b72a454ea21fd8bfdb1e541e9a33fe7e7782642376b9bdbe3fec0bcefa3d7b09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e8ce6e332ee11def95221370ea2180b

SHA1
758d7f125589b58a40a6fc220769179bcfabd07a

SHA256
bd8feb8324caefda907294bfd29745a57349fc8fa2be29a889ff33eb6eff4d01

SHA512
08ee9e468034f23c062bc389f6836cd688a1ecd874a7c9ad2fd4094afb5ca4e3ce22a38473ea6249e691e40579b29df7fd2106ada99544f5edafb2865b9c7da5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
442a4aa3a0c67df255e98f5f4a954d07

SHA1
5d7e204ae542589e95344630122f7f34d440946f

SHA256
2705fc0180dd829ddd0f73b900f5be50590b71877dabf20ab94c138ccc3ed82b

SHA512
8e4aeb4089cf44d31172620b6e72979568ede003fe7fe37e13bf05a4d26006aa2646565cccba57c717491380c1bb6d812e7cef66f2a7dd3cd9a20b4ecc1c2afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07e6831eaaf281dd908ea2fb28f44b21

SHA1
077797fea36fe422cca662881a537cc865b0b09c

SHA256
fa38621563bd190aa12037c58eefec9c0f6b9030904f983c49ec6967dc823459

SHA512
54889f9eb897d40bdf4a8bb3beabf0890f9a1e3bd7fc8412e7292d78d9e782c52a723930b0a5ec766aa28b18c3d65770e75ad27e2794b5ac091eeb7468281081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b347fc8b5e9b86ed0aecccc798548ba5

SHA1
9b1bc75bc16066462187ac91d21a924f4ff67475

SHA256
252050038aa93e56f4b786d519c4fe50c3d4e88707eec208f9db3bac198ff302

SHA512
67d0fedac4396e02cbf8ed69b6e95be1af2d6bf4e21de16e48cb2ec4fb7e52e162417e7f92c30dd03de17159dedfe75cb9b11e29e905b9b49e8fe670697b6dd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0050861d17d8e7dba20555b19c08bc9f

SHA1
e2d823b79dfde0484a8d82de67cc28e148af5ed9

SHA256
f7d163c2c8144c023700dc8f3518c4188a2728418a17231d4449f4cf84f562a2

SHA512
ae7c31777a93b1b1f6cc33e3509ae30db9995ceb295c8deb603af1646d14b1e19cec1f4bab4616630cc34492ba65679999f39e0ecbb4477bcce3d82f042237da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
705c0f7d858fac3ff15417da78f08921

SHA1
46c8d0858d4ce95edf16eb57d6ac1c4828da5407

SHA256
45c953bfb084fcad0cc3dbbc238e3a8be405a8930bae8e0e4568f37b03fdba12

SHA512
1e832b915b9a5387ef427bab0942e22341a69b88d250c05f1aa9f3a7e5b02fcc7e8cce74468cfc9366129a6e14fefc2d94188d0bf302b65dbc5c86f25ba25146

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60d7d098ebf3c4498581c71cac6209f1

SHA1
53ef3cae1060f42ba9ac8406d51fb76290cca17e

SHA256
99f9a0f635668201cfb4129f2530bedb44ee063d2077266f02aff6255a49f501

SHA512
5f4c8262b5c0fb8757ffe928783579202a8ef9d50bf49b02badda7d59fafadbbd007e39ae8ffb6adcb844c4a7048014b7545f4993923c5fea207c0653c8f3392

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar79F7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit