e99743c023720f859ede82ce2f1d42fe0a101eb64546746ac9f3fc0930beb575

Analysis

max time kernel
140s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5e42835116c828fa6db5d9bba8b0fe74.html
Size

82KB
MD5

5e42835116c828fa6db5d9bba8b0fe74
SHA1

7e9480ddab706e3ea7188bf498c3b582bdf1afa4
SHA256

e99743c023720f859ede82ce2f1d42fe0a101eb64546746ac9f3fc0930beb575
SHA512

77ada13f937e328ae22d1f5bf7000435a4b4c75e6a247c26202507d2cebe723e66a0c8d75de1d3bec81888221908af8a374d4d094d451f97234f165c9805a242
SSDEEP

1536:fhOrm46BlwtrHOeWrdLPccaw6E6z3K+IMz+5m5EwpoNJxtWdY0ywefYRkHXJ3Tc7:g0eWJprSwes5Dc0Y15x

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409844095"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5DFC4681-A4B8-11EE-B383-EED0D7A1BF98} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40fc5a43c538da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000c6f34705bf463816f45df4a179d0cca31e3e0d6378dc43cbd8099816d2e23076000000000e8000000002000020000000c9bf6c6dee5a50b1dd61b8d7468e036d850cd29a4114d4687b50b3edbf15f3b4900000007e630cacbd87dac0601b9a112159fce82f19a9dd39305c8220bdca594fb1d6273a30aefd8407df033d12050860ad374bf5eca5578426433a8b3ce58cd26ff96aec168293fc75fa01142cc6dbed2c007f285359f9b3d707a7d54cfb6972ee6d53a18a3e646bb6a148352aae6c64b52ca2305df833b08ccbb8ff44525ae1a0d79685ce79776a21d31d27d6707fb951d51740000000bf6ecc4d91f61699529178000a13ea6d054d92c5c94a3d224a5e78d6fd5778bee045d33bc2934d4638df216eb861870e9924c3573478feb503a6e82ad67ff3ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000067ba65090fc1e77d241c6a2ba25ab3d48570d6dd732fa85adf52e6bc1ceff3ce000000000e8000000002000020000000aa14d15406dd24ebab17c69abf2506a63750da70b47f877bb0d6dffb2d9ea5b8200000005b657227ce4d11004f8c2c2fed042e2e9aa3e4db6203e3064e488debe98de6bc40000000be451b0e718bffff5c173ea077900dc293137d4146dd4bf6aeb634fc4c65a83319c5be6fa068736fc0fe63db79c7866ebb9019eff12ebc90f5455d843d9827f6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
284	iexplore.exe
284	iexplore.exe
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 284 wrote to memory of 2288	284	iexplore.exe	19
PID 284 wrote to memory of 2288	284	iexplore.exe	19
PID 284 wrote to memory of 2288	284	iexplore.exe	19
PID 284 wrote to memory of 2288	284	iexplore.exe	19

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5e42835116c828fa6db5d9bba8b0fe74.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:284 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2c9386c937e03abf6c37281b16cc09e

SHA1
b43347592f6ac546d36498381c63f52bfcb5115b

SHA256
bd1b3102f29cea21aff344a0f6a0e8d73df57daf39de94dd0f630e4cefe366b2

SHA512
b1bfb90e6230b07b5f7a86b305f052e42f03bedb525397a90d48e660810137cca1f914a4c8402a19870654a8f662c02e316cd08d8697e66873762b015c24a2a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6e735307489def04eebe64aa7e6ce6b

SHA1
94c31a42a790569fd2fa3cfe45c52b5e87a7c9f9

SHA256
719e245dc14f9578a92097c5e0acf65843865603091735001f324abfda0770d5

SHA512
732632c5e6e6697bf5c423761dbb225bc4c119ca93cbb15833a85c237d5e8aba5048c812e13a24ef756f561908656995a018735c248d2f58bd1b6eafe59b6266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67786387692c00c6b1236571c8b37af1

SHA1
83ba4d7f1445e53ad6ac240071478c23945e5208

SHA256
45a88a0a4223ccf6013cea3c93ffd0ae2517b0552e61b06210369f41bd3f2bcf

SHA512
193c726d47a494a66492a2c96b35d89daf05b25c34ccc10adc453e40e6d268e688e8e44bc3adadedfb7097e36e317d8b49d830972919c49538f0dcea7a7f6558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31424447dbb4ce4d7d44cc3102a8e586

SHA1
760526a03319a6596138ae2109d54c702568b301

SHA256
b3e984fb7c7f075c36710f15e45e71a6455d26871d3edbdf51a33dc24671084d

SHA512
e964f84d0fb97e4e9aeada7a673f296b35ce63cf0ef828492f6d88b715ef2bff667c9439d1a252915a4253c017a8b55ee8f1ac4c62a489022e4cc9a0eb377810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5aabae313400b996fb79c92cb1882d6

SHA1
0a27de8d209090db33acd54f64ad0943aae898b0

SHA256
cd7aa69d51ef681be8cfd150ca8dcab0f136a9b43338c0f5699220a25b638f34

SHA512
4c098c8c542527d5aa4a9c1d9592faf363d92233720afb61972ed9671060e969a86daec0f7b7cd8975affe92f62257e6eac87269759de2b8d61c73e8f003cea4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47f3bea71e355636f532576b686e2fce

SHA1
b7536e4fdcd38cb99205d16cc09743d1a39a6b4f

SHA256
0bf60a5939e57a30e312b1058918f5c05a568e608e8efbc5d28cba6d175d4cc1

SHA512
fff0aae654c98531f162a5d03df409337a17cece6063d2dab2afe26353b2659ceeef28cab7ab2bb8f1245866fad6d75a952de950808df9904f00b2ddb2e3bb3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d3deba8da4ec50e2eabafad5827d37b

SHA1
db50550fe309f2adc8da60d67aea72732d8f4ff0

SHA256
ef09ce8c687f5fa5b476c2062bbeba2e80666d41afd31cbdcc31095ae7f02b07

SHA512
363005291cbcfb6aba0012d129a2c0b5fbf6f3e5097275eebd458205fa655e0eca1db85477338962fe136b88f4cbe6467e34a2ebc36ba2729ec52c4354c0a0c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10e4d26678f1fb0238280204dbd7dd37

SHA1
3d6f9a896c6d878893da65451036cc913b51425a

SHA256
1f57fcf27c722927af830ccac0fac789d9589499e537a962414d1744751555e4

SHA512
d56bcf3ddc97bffcf0c55d1ba42dbfb5d6b4aa511868e7e085eb73afe3524daf90eed8b991a208bd5cb474e09e91fe0e54ae73327465c7b889fe0fcdd29f8b52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f20fab800bf81d4f42be8fcdbf50d9d4

SHA1
1097702f362cffe5d7da1520e79582fe9011649e

SHA256
9a1cd0bc9eccc840e3df3f30f84ab135359d18059cccc648499f8388e9351060

SHA512
1a63023d2c4f5ad209cc87e8a7252a5cd0beec21b91eb5f8e6f5f52bb63ac752d2b91d75cce87b3240595a9795097ed21b18c11e23fbccfad8f49e3501d955bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4feb55c72017a2445cc05b804815a5c5

SHA1
ee2aadd740d558caf43c73c668dfe868fb9cd7c6

SHA256
b122381d2f7111f85ed80ca033c8e209d00f791873c9ca18e356e8938dc1450a

SHA512
98438e1bd4aba0370793813009e7968998ab44766fac52bd41aad070c03d2ad5d80af63866ec26c5cd49d2030493020c344831556b4e30c96408105278a025f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
198f695bd0506054bd451b681dcaa8d8

SHA1
681f11d0f9dc1f16e17a9a932b11932026fdff3a

SHA256
59b11d3760ae248c42f7cbb75cc118eef3636c621cc300b293e337de7e4a4aa6

SHA512
65d5260ce6309847bf2b5f6fd8740ae80cd36f7cd4bc43fca3f6d5073cffa1d1ff9e8af0d2e697f64cd3c7ff3ff6d7b009ff7e6d44da572d5b26a0af8e222ed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEAEC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEC18.tmp

Filesize
128KB

MD5
a34be899401d36f5ef0ed9d1bd4b2ffc

SHA1
49ab851a4c1c36c79895ad5e63078c85e6db4486

SHA256
bec03bf3bfe6a20bed12efe3ba625c1a31df2d8c5e008085de11f76cffe695a8

SHA512
68291fac36f3b7df0166fd7b689c735e220a5b200512eda4e38a6d81255a8d4d7155efa928230453d854277b753c86c02a46d09b73afe1ba842940bcc55c2e2b

Download Submit