287db02271fb4d1a2b17a56941484a76c0589c7acac2ed2b29d9b80f1ef51096

Analysis

max time kernel
144s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 07:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c81c1c115ff55984b2e70758aaf7ce5.html
Size

19KB
MD5

5c81c1c115ff55984b2e70758aaf7ce5
SHA1

24a76f92fe23b602486865d884dc96606bfab0dc
SHA256

287db02271fb4d1a2b17a56941484a76c0589c7acac2ed2b29d9b80f1ef51096
SHA512

3a953e4aec0d769118da524cae542a53915c9bc0bc91645960389ef2c496fd6cab4d984177ac4723995dffec97e8aa566508a2553dca69751839bc8b5eeb5705
SSDEEP

384:811bnSvbIqWgFwDf1u6R9OIhFi42MTpbp/sSk:8PbnmEqXwTZR9OIhFirMTpbp/sSk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005675b55340da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF911EB1-AC46-11EE-8C17-6A1079A24C90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000004f49fd4b7623293ea10bc0cb3d646b65258c59597d36876d634d0894db55e12f000000000e8000000002000020000000a521228de3f9b8d14a2b462e3619569a8b778b690c28c7fca26c5a87836382fc90000000b538a2f9210de2c9b3555a1a7e37053283b556dd9d8581578a5dd2cb3094fcfb9e65b73efa1fea30d881be4459efd92f21d4efa456e13e0457f5cfba21fdb28e6c2b72809a64a2492e3a83465c6fda05b6b66b5d3210620cda9b439e3488ad439eedbca329d032c8db522b78bb17ab2773532beb644edaa8eae6179f92262f33d00cd76337ea15630baed24881c30f5b400000006a9ccf87eda721014bee8d2c266231b50cfc1463e085b3444d55d92183c90561434a3e2b5c9f6a7bd1f9a8d7a4ed012f53b9e5127f6a3e8c8fd8dbe8676e8683	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000005bc5897cf70462f7884c13dcfa6630cd5a30f8508c88d5f7753a0a3922c3e3ee000000000e8000000002000020000000abf7cb48b05f218864e35f3f63a36bfecd1372d8caacb9b9382b6119ffa3356a200000003766d3e2952a328c49fd3a2da313452f8f0ba046bce9ac5358ec19d42376fc5a40000000078acfb5f936efeadc35d249e2dc07a5639debb6d45e971de5e1b6aae2bbeef4f4241a443e0990377668fd66b3928f2e2967ff0fc3f399dea71c9fca9a76508f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410674966"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2472	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2472	iexplore.exe
2472	iexplore.exe
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2828	2472	iexplore.exe	28
PID 2472 wrote to memory of 2828	2472	iexplore.exe	28
PID 2472 wrote to memory of 2828	2472	iexplore.exe	28
PID 2472 wrote to memory of 2828	2472	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c81c1c115ff55984b2e70758aaf7ce5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2472 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93eac76f594d94afd5c780e803c8b1e5

SHA1
62b7188571c40b64c1ea0b73bd76503c532e75d0

SHA256
11b21d865085878e9f5c4ad963ff90f0ee6d3b6747757b3843534cce0771e014

SHA512
51438eb7390cbb9d0710da9e5ccf66576a27b4b91414d436851e1584ee6eaa38829b288393d3a9094c0d9f8e666591c7ecbbd0a0113f16328383aa781d452745

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09104115a0d36657ee10d97fa0e54e46

SHA1
bf07fe2007ea6f845b51383e1068a71af39cb642

SHA256
c4ad8f44e4b13c25c9d339e1e3e1c81bd3672bfeeb524e3ec8bc242aad433d86

SHA512
f39e5fa576b3d4046da0ed69a3b0b839018c877558ef6f38e27cf5464cabaf954d8ad7b5d8a3dcc84020ee208ff701ac7b2b7bf852a9b3c37b891142328df0e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efaaf5104a429911315c467db01cb714

SHA1
b13b2fe4cec62743e57d5a93d1a7450e815d354a

SHA256
14c802ab3dc60b2f16183ca1e367e6e46788011fc361d5ef1dbf04a97f616048

SHA512
791392aafe476ee1d35886bbf64f487480a10e4e7c4ef0b3e40a7443f10676521b70662aec045d017d491f28e6bebb82827f00caca107d3c21a00731f16eb505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a35c7b2f7c371deea88ca6712b500d4

SHA1
7cc54745e0dc34314f6d4df1270052c4764c075a

SHA256
eaa82b6611644d8090d7694d67e4ac0f8843f18471aba9a4eceb71b9d2bb4738

SHA512
7a1f9aacb0512ba5e8d2d395bd24a6ec599cf76f071b1562120ea27141985ca815bb809791b385cb94a4990a2999d22634b3e5b1f11e91d84d488023f63e73ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66383a6726f128381317047cb900b106

SHA1
19eba4900b29b0afc64f05435f578fb171ec1f7d

SHA256
27f4eb04f708c5bbb5901708593327108f34161083cd8978cc64ecde8652f597

SHA512
9ffa7e0b4e958928a7f6f838aa375c0fafb9259c440e05fc8632efedbe7e6711c8d40324ad6364444489bfc8fb76fd3848876df803341e428bab61e788142448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d456878b5decab1e2f9e454eb3b0b6dc

SHA1
58a39a778c976fd5fa7638dc47785cf94623058b

SHA256
83306111281c9c5c2f2579a2a3a27842beae81b2420f12d5724abd82462a56b5

SHA512
7acf1927f217c3762383d34f349d6be77885e39a265731b16f3b6276da7f61eb89e37eab895157ba141f37613ca0d420115c6b6a4de33b0a13198831ae387f0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cdf2f3e9febd71a9bd0c896bfe3dc35

SHA1
7d0a875a876892fe2f12cae7b9e58cb96aaefee8

SHA256
95a52369a1041f1a226dac5bbfa3da8e5c8b21ce950eaeeee62dd8fdbd415664

SHA512
6fbd4fa59aa1b6ecc114ec44fc3874f16d70c9b9bd91e56d183056779d7fbb06c2e850bb2c4aa04a55392e3bdf8fd72475027a99114a1c97669450efe2e58524

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d04140f41508734dfa5d24c91767a90

SHA1
2dccf794825ad5a153e9f1d5f8ffbda59d9c9533

SHA256
7c3ff25f84a694dd1628aeaff13017fbe002c92f1a3ea2acd5f0eef9e296138b

SHA512
11c1909ed3204083b43fd76ec07cb8653384ee8f6cc0cf9df41684af8c8f457711a67967a14492855c4b567d5e567ffbf16de18b218396d4fc8a2976d5f1960c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f34dd16ae16e0f337a8388a0378c5fd2

SHA1
eab51e16b05fdec96fa7e90d7a2dd42776415f5f

SHA256
17d7c62fb6616fa9dfaa3c31415a881f9cca56aa33187cad2590e08189b28711

SHA512
2ee81547931152889f0bcdd68f21cd982af58848d21c199417256f4c74401a63942c025415fec3c604a90c24527701687a6f819e9d49e717b0af864c19fd1c18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5599c6d482632cb7e79ff78ae86a4235

SHA1
d50fcb66257f8348aa7f4ebd60274cf3f2c43684

SHA256
be316dc814e8e415c5ad45cd8aa343a102ee53f17b4601c9ff680a8172f3b322

SHA512
4e93009bae3eafea6d87a73c3e009c719c7bf59cba204709119fca5e26108f60ee6241042108305ece6bbb1070a83444cc5c24c34d3918105aef7315f777e61b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5da86a0b7ac0e43fb86580c79026f2a6

SHA1
9ba77efaa5bef38c0a8f240d39a62f5e604298ab

SHA256
ac733d6a19ba6ba4d6216f46683f875cce8ab02846c53313c7a59cefe1ce1f73

SHA512
cb65692b34f68c382718626ce9283f57ccf668e38865d9cc2925f01d9893c5b1c3c2366aa5bb49634cfc1787f21d2cad85570166579eaf80210c36044600d7ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9628.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar96E7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit