e2ae55392b1e17b83c48958e05af32b5b211ed33421ac9c36f85ef20b9fa0d3f

Analysis

max time kernel
141s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62eb005efc6069ecb2c1fd25bd6b3015.html
Size

57KB
MD5

62eb005efc6069ecb2c1fd25bd6b3015
SHA1

318dc49aea817ab07eed3ba87229954e3c59babe
SHA256

e2ae55392b1e17b83c48958e05af32b5b211ed33421ac9c36f85ef20b9fa0d3f
SHA512

bf37824fc2309657ee4824d416a324bc6345d5d0274db29d96c2256848f6a419b7bfba142aa37b2457ddaa0d76ec7a28436f910baa4bfde47e1962574ae4f9c1
SSDEEP

1536:gQZBCCOdR0IxCeVdbfvfpTf0f1fpf4f6f0fUf5fBfefAfKfNflfjfgfafwfLfjxG:gk2v0IxJHtc9xAyMsR5W4iF97oC4zdhI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ef8ef1470f7879230ea09c9e3c1c6354db961c0e4d4e97c91a42f98c813b0050000000000e800000000200002000000027ab76e7f8d61785fb58dcd17ba3945d253930e8d28ad137ad7a21080b08aef1200000004585fe8ed0cf2ec9d68d4df7983a7d9f86954fd2667ac70eeae719c2f6bff71540000000987defe86615c2e9ec6f994b3c9c1340826af14efee1bfe37d5220f31111da766434bc58fab57385681eb19d28b776f778dbde55b3e64704837062631b24a5ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A88DDE01-A4CE-11EE-943A-F6BE0C79E4FA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b72d97db38da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c479ff89d0062d1999ca02979f31897b94948417b9503bb64f60d8828fb1eeb7000000000e8000000002000020000000f0bc07db8333f5b186db06ff1a93a8631964c4a0247d5445b6a6f8b2c51bab81900000005e3c883c9bcb37a29faacfafe67013b6c9008a641de6ec6c0276fcdf70d57eedfbb60d83cd48a0f769238edf3ce769b4a331210a903d4788408fab9e6d6ca004506eeb35e179babb478f7f06b2e5aa25e300908264f0685b1ed87655bdcd5a9afedef46ed671b9c6190fd6e359ae2d68918a6fa63aa66ea7717ba025a1ce51408710550637d0be2d5af4da56c2924cf640000000c91431edfe40df0e09e49118879cd1d0b81bedf56b4b32d26efe14b2a972d4d45eab408ba1b4543b728a1eb96af967004b5b23c41afd4f81abfc20edc1e89f29	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409853673"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2780	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2780	iexplore.exe
2780	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2796	2780	iexplore.exe	28
PID 2780 wrote to memory of 2796	2780	iexplore.exe	28
PID 2780 wrote to memory of 2796	2780	iexplore.exe	28
PID 2780 wrote to memory of 2796	2780	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62eb005efc6069ecb2c1fd25bd6b3015.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2780 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05a7bcc6f9082211e7a2b8dd76e9e8d2

SHA1
dfb523fc48da3260b0c24716c888c9b44056b8ff

SHA256
978b7e8238d8bab2415c676ca70eefedf9cedc6b440cc09c15c536c07c124c67

SHA512
44808c42fb8948fa1fa4292e1af09dcd4bdf5f0fed980619b86e292429a97a2fd15ee727889c2596d52c54956dad2ecf41c60302967e10df6750795682bb130b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1ea1b793abd3694e2add625ef0ef5c9

SHA1
2cb20d7cf1acc712178394fb3f7db3b966786641

SHA256
9e80f7dc0e1d9641e757deb3f9d2c7e8d86160263d7fb50061188040a95cc0ed

SHA512
3df3d871df16430eb3f0d4e1b0d9ee174424ba052c069380753f23847d18c361048267e10c1aaf2831028a4c93e01dccd7bee955c3071061cc9e148bab7fab49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a9eb95f014326c170a1cf0d78118799

SHA1
78de44a5a62f16452d291cadf4f4f62bbb2eaddf

SHA256
d0c041ce7e0cbcd0c81e5e0cfad6d2a7c26f9415dea65d52fb78de384eab690d

SHA512
53487ae8031df7cba6942fd9896f2e8eedb733e0170220771605b7e28da2e66218201072dd21098def167052f716a899cbf3df9f5edc13b471893951d0be9448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6349f7b2251f03100da0bd56c689c940

SHA1
8498b675345cf6213aaa27484d204f5f352725ca

SHA256
63a20b4dababdad0bec66d2d5ae1561896b7a12f3eace02a5db3ca649fe32951

SHA512
dfa8178b8578b8f8d7cdab11d5605175927d6d052bb65852c04dfd5a448fd82a0509c196e40e3f78fdb7a84fb943b7a9942e50baac13045e8064a2b4c10e6ff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bdbd64ee48283908e9bc88100c4ca4a

SHA1
2eaade2306eeef231d036bf7f116a6c7cdafaed3

SHA256
aaf5154e4eb7242c4a2e06019ee34cc5a83a61c4ffa9f9aa823202f986742d5e

SHA512
7718cceee4306e2e88efecd973a345b796fa25aec6940459d88d8c71b44b3eec87ded7fc6670f31927ae6b7d134fc175fa11dde1bb6a3aef8703787f91f53e50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35bb765d85ea223fa1f94f00f701e01a

SHA1
62fcbeca31951b9da7dddfa16656f20abb5cb15b

SHA256
68041541615c95b79d13e1c70b350de60590692ec4159046e7ae5eafedb2fd55

SHA512
bb214eae022fc3fe6c925ce6f10790a3c727c314edd15fc83de5e6cf7253662cd17bf5acf6c9f69b2839612486fbac028e6bf4e93308d1e9802652be5fbeedbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb53a74f23b436f669532776de064ecd

SHA1
06bf77ee232b0ccfb88da06e2303d6608d08a4ff

SHA256
11fbeeabfa659ce6b9f1d49e311c76e0ae409bd467a4a7930b5c633e7703b94a

SHA512
7e79ee816cdc3c5c64a4233196fcf361d5bb1482826939b33799c43c7413a39c8650d2181de4f57fbef7c385222b96becc5b4ad8de67ca24dbf6160717a92757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eff140f93029140a3069b33a6893b6eb

SHA1
ebe152039eead0ee975e542bb399666a3c3c2651

SHA256
382c1eafc4fe4433eee4be78ba673651b4a56ff94d5c21bea500b4a37474c378

SHA512
8709995df22a6b60ba625927a368314b3c1077460fe2d18604014191c2ca586801a79705835fa1f6dc22359a71cc8cc3bbbc6fafa64ce4e1d27c10c5be62e009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3e1254e48d83c8d750c962f38138367

SHA1
9b9bf31622e81095fb022c0169091ca14ea5e90e

SHA256
8fb7226028b315ab2e163f1a554c8b8a8df290eaf908108a0390b19e37080a40

SHA512
e11df517d5d2d20d55505432a6f0be8be0bcd040a1ab9239e9bffcc213546da4c8390abf19c801ccc7e154170b64d02e91461ce697dc93ed55b864ff802420c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b52dcb9db3955bf67b3aa54384339d5e

SHA1
c05d32b7cca2ce673b0c4a540ded561795aae644

SHA256
db655165de7592c04e38a2b12a520d2fd4fa398a8c47eee3ab7bdfd7ae0ec351

SHA512
7f105663e69b8986c20ae5bcf669b1264222b610b0f561f763f9fd49c187d2f8d637ea3d9d5b3fd272fa32870fb2572fa4c5a016922683c08d3c51aa8b926dde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d5743d16804eec4f99abdd73281e90b

SHA1
b52a7206711ed797a86111260907edd6034337cb

SHA256
fe091ea53667e0ecb416102b3ce1b86994c85091ff97a29b69c863591054a2f6

SHA512
e241b85f3fea9bc12c4204db3c968870fae0cc30ef039002b0ba76be4ea00447f77ec66301fca8576ea862c3abae755267034f42bca18d6c73a3b22789fd0886

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb047ddd6128fb3067a0719a94ff5b4f

SHA1
11e8be307a3a09f1f5ade4b13879ba93c6358cd2

SHA256
5cf923c7b78593ff8eeb220e81383915f0912d7c6cb17270ce5510387db31288

SHA512
6be5709112ba7d87aed7c6b053ba58a6270b12d9d38c11b1e228b3df63ff677d7d6b4afe762d94644fadccc92c637e9170f0d574596d2d9f360d9be7e7962ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8DD0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E21.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit