5ec5cfdeabb9b2289bc6e1137f9f9d0c44350a124c82b157c0d988962c022543

Analysis

max time kernel
145s
max time network
169s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ae84a346b7047712d9e615f5e19ca69.html
Size

41KB
MD5

5ae84a346b7047712d9e615f5e19ca69
SHA1

c96fbd0a8cd4e2b975b949dcd6663a74e4396f0f
SHA256

5ec5cfdeabb9b2289bc6e1137f9f9d0c44350a124c82b157c0d988962c022543
SHA512

6c8a038d014078fc312853e258634fb165431d21763648e2d66819c32b2b4f26b63f6c0477dd07d70abd80fd8ef3069bf3b983048559210c645e0131e07ec8be
SSDEEP

768:zX04pC+hgVCEgGnno5xaB2iX9xv1NCsho5xaB2iX9xvE0r1S2SXyts00:zEOCLCE9nUshXr1A

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000002a1e322c2a0315708b3ff9ac623df237a07e1f2bda055e2cc64b0e96b42df5bd000000000e80000000020000200000006b68bcf7fc1eb6af4f030c62d7d9668c75e5d5a8d501a47de3f72b0155ce2c00200000005fa94375bafbd46e835832fff7c5bb2a5ca6fba9b0fa03694e864ce905ec2db840000000bfaadfbc4cbeeef1e1bd978ff510947d17e6df825ffe95ee1028f6c3d40286afcfac7c3cbd963452e450f89a8602802d20af7a0d8d897edccff0ad01850406f1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000159219dedf22a19eb40b346bf22017bfce31a342526eabb3bcebf79183e97d75000000000e8000000002000020000000de3b33d28fd88c3cff7c8f476e4ae3d45a37a12d93947bb1946ea0650d5f6b8690000000a6d2250a4528db03f9d83d19791dff6feca0d50e518e146f206a402eb59eb2a0fcd25f6ffb08240fb162403b514ce0ddb50c908ebf777b4296cf444b0da076fd34a53752bed69af38cb3d3e5a5ede226f96742815b17bfdc012b7dc9572ed60c367f6dfb0e7baeda5603a621c9fbc8853fb0b0343513d004032a68d8489211dfff51c88aa101a5fe33e09d36ea1aef2f400000002d73f074f7881b205383fd6de9d2dba20f26e0f39a2450ccdfcc79a072ef70f84452679b6150e80afb2044fc8a1310e75a8f11a0c17629eda0c45fc45df3107f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{825933A1-AC3B-11EE-AF10-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5071746a4840da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410670082"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2476	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2476	iexplore.exe
2476	iexplore.exe
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2384	2476	iexplore.exe	16
PID 2476 wrote to memory of 2384	2476	iexplore.exe	16
PID 2476 wrote to memory of 2384	2476	iexplore.exe	16
PID 2476 wrote to memory of 2384	2476	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5ae84a346b7047712d9e615f5e19ca69.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78fb952a4b9a895069607c39347f8cd3

SHA1
dc6ab6eeeea3cf71992a5df296d4d9d0c11e6899

SHA256
7502fe806c703920ff684b6f0d5aea5333a11a37b807dcfcaffd9db18a99f92a

SHA512
ca5518394ca6e2dbe5d14af194ee9192f74c01c6f1d4ec3b861957f91ad5a554e718d15b7c9af0f77feaf88a5167cddaced43b507b40eced18a8f2ced2ab7f79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec3cfee72df50b9516e25d23cc56fef9

SHA1
e5f906a0cf7303963894147dc451394fe071b5ae

SHA256
30308dfd698139f59f51dc445659fe248f282697d99352c0f44710cf3ec2be54

SHA512
fa231d68a8d1b04f831f2974c38f3bb52e8c8fb2bf79deebda11ba4f6a478ac2905ac11e6d2bb5f5c1bdcd8881eafe7a16c64d960705a9adb7e9d7bdb38de7bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a24ceb06f9d13952a98f73cd9aadd60a

SHA1
e83bf94e3f051d21ccadf96c7f741fdd3dfad59f

SHA256
24e79eb0d6a61f0f8570c3bb1c4694f4d37e065934f492fed2036391bdb3a2d9

SHA512
5ec0968219c02fd880ee8894aa6af57a44ce9ea3df348751054cb93569c787724ae3c95d8e927bf9bf89d3c58f4e136bf4e42c803da820c0b06ca20609da2c2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6832bf1a61b710167ede9f3d051010cc

SHA1
4ebd3432ba6c4f9443067ca8e5c9c8021ae482b4

SHA256
b8895fbcc0e212f07dbf3ab9acca7b2eb306d88a4bdf1fff6b5de5ba694fac2c

SHA512
59589486aa53c8b3c38c27ba6817ecef0c5710b4f59e12bde6eb24e8186e6af918371efdbc6887f59acc50accdb6c21da8a9968d0b36b1a46955ee1e8ae6c089

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24573111b7303c83d5ce5ab1d51d1a64

SHA1
02618f3a75515d38ae15dfefc56545a3988baec2

SHA256
165125bc05e2a2c0e1c4bb5afc830a1505b616f27a90c433a727e4d2e359624a

SHA512
6046ba366f3c69ee359c2ebb317c6525bbd50383920240b244e209eb59a7cb16d11c7db9bfac7e404c16ca044c773022cde8f2ac155e283fa7ae06884465fca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
330ff1a99f93c044726e1b54f076b790

SHA1
fc990ad3d27db53ccaea478b333b586d531a85bb

SHA256
bc5d9b5b499dfa1efe1aa466b2910fd0922976c7428208548641a651c426df96

SHA512
acbb965bea8275f4ed30d9d3a2baab9e7364720e7167650320eeb887d9e0cc510aa9b49ee627879002a15b89d83ed0a1257fd4db36ec8d54916ddfd786a7c70e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc54ea4f0d6911da0ea29ddf35492b68

SHA1
72cee2eef97817faae19d3d999a392849e93a8e3

SHA256
243bd7472c4cabe84fdeff6ad5e3546076b489df14e5e7b489e035138532fcad

SHA512
98cce522f5d0e0ad8624bed5a4e21a4b5d831bf349ab975f8f0ece50c2d8886539c6b10d11c619f02f561668100d015bed95e8ab7fed64b00caf83e66143fbe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bab7fef679166f0f67c1b629f1442b1b

SHA1
a938b634eb0bc55f98892e3e1487c9b9f5ef7144

SHA256
a73cce28542ac3cb85a2509aa60b05c76fad1541243e8c414d49590535bfdf30

SHA512
1f6f6394a0bddfbcf34ef1a2907b20121981edc00ca50f2b345b450264f3cbdd19dfdde9d89dc4a5e758efce15b2c843a044a5baeb114140c7896e5236148520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad7281a9d3138eee1c22d93a2308cf86

SHA1
f63c45c971eac414bd65ba54324e4decce80406f

SHA256
82acea8654cd97e5f6aec3246941fb6ff8a0826e1cc9321d310dee63d6a1b76c

SHA512
a0bbfe4becb8d61811e8314bcb680c3c446816edd8c21f2e3d7f24a85433ca59a5d8b7078e6a462ef6c3603a70bcb34f59d1353401aa41b25b6a030e8fc1e687

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e276af9cdb439c5a6c765a324f0bb2fc

SHA1
7fa1a3b786a80b6d4e43a51aca271d4979b11317

SHA256
e409a0e4ba0341825db62de05357cc3eefd07f426a4eef9a71f16812d8056be6

SHA512
f028ad608782f7fa3cd3a3b52619bab17a57e3a03197bce19238bda313a51e2e3f38832370f1cd1c3e8e403f480e97b40ea8af3a792bc5ed24f55667e411ed33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab235B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar237C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit