a755d626457ae49b53231a2546157790172b45e36790eddfbe7b4db838b252f8

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fc71ec4b2617320c69a94639c469c6a.html
Size

46KB
MD5

5fc71ec4b2617320c69a94639c469c6a
SHA1

72d165e691030652fbe8c06369a3207f481c6614
SHA256

a755d626457ae49b53231a2546157790172b45e36790eddfbe7b4db838b252f8
SHA512

34b2de82fdc769020480741cd33dcd07b4f1335a703f7afdf8b808f937c79ad82eaf9168e0337d63ff11e37c726ddbee54b35094b28e23677b05fb79379376fd
SSDEEP

768:Sg1YptSR5hnNxz8jLvT5vrvdWfsd+vd5pHVdpG:SQbsrjd+vd5pHVW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000019521ddd4ce8ccada5a3807394330d8372caf48d5d15409a433d2d6d2685d505000000000e8000000002000020000000d76ea458964df809a1abbb791141fa6063715423a28341619d1a9be43d4cf01b900000001516d759f69cabec394f6496fd901aac2e4d04b6082b884bd35b86c48784605d0797814a9979a6b27b004853be4da5a19b5d5186641d70e4779ac30b78679387ea5a3fd2f3ed4f14e1ffc6cd369ed02c99928bc246589c9ef696fa0fd2943217ae1da6965461a550a72fcb48d9c776363c75d862de733e61fa4c56d9b863572a0caf227c2df4676a05cd48ac6caafaed40000000334d723e3bb96ae547698bc5766ff419c52bee2be641f9c9fae061110f01d264f536bcd1cd03c779c9891be584c372593c3f37c84cb72ff27098665174eb8139	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7335F31-AC5C-11EE-86C9-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000befc4f35d273916063923e414a07516eccf0090ca49d0cbe5903878fe01a12b7000000000e8000000002000020000000eb2a7749feff0f076ab305d1304802827003e8304343fb8c4ea67fed6230b6f020000000717e80487728a3a834e4bbef30453636df19c03e9416ddf675c72db237ebf90a4000000000c5fe209d59c2466bbf2198cf2e09aad8abc3db683578b5a5956bf2267571ddb9d9d038943797a234dbe2353936076a25ecf195a919f51a2d014180d478395c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410684341"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f09048976940da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2460	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2460	iexplore.exe
2460	iexplore.exe
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2632	2460	iexplore.exe	28
PID 2460 wrote to memory of 2632	2460	iexplore.exe	28
PID 2460 wrote to memory of 2632	2460	iexplore.exe	28
PID 2460 wrote to memory of 2632	2460	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5fc71ec4b2617320c69a94639c469c6a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec68f98d9ad9db86d0d65826c42b632e

SHA1
14f380d409d1b2cb475e7ab8a849610f1f4c2f8f

SHA256
f303a74aee5b965b50161c1b6e23f00149138af3409566ec888251210bdc447c

SHA512
f753c94df1f5d2b9f1088fe8d263d7ccd994d8a7f29b11c75d4e17a9941042c950dfa4c08cb81f60c087d70a472d3e9b597ed1e7383db1e565529f6d713239a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaa3e570a0975d4611b85a7744301a46

SHA1
ffa52a5810b74aaa994f79c2c68d28797200c908

SHA256
cc0b492404ae233e629fc7f9712eec69cb7ae49d92d5dee6eb31b695789dc3c6

SHA512
95a27f29b75320e92b5302dfe54d980f595d185f77d1270429d220b8693e4ef10fb2e139720c8cca55960821c07cc04664f43eb350deaf5da23e0f6e4e2a7507

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c3d581eefe6d5e7f65d0533a067d261

SHA1
8b074acd8d2d2a88e56c632b4541895f67828331

SHA256
0cd0a4f5b19f62885616b928d2132710ac17a1e8a452b7b1f6289824160148b0

SHA512
e03e66f9a732443999e291bc44cf452e7c84e0879e8c8c430d232a44d2e636eb2f019fb5aea3335340e984da4402420c2c8ab8ced443a631dae4441835e8ae1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdee6b6c5290235c3fe30ed443305dc7

SHA1
11e4ac3d8fbc3a3ac609b7e6068cbe386cdf56ad

SHA256
c384ad0b1a92142cf25845dff0742def301b48a2b3037a6a520d66b01b745c46

SHA512
9973ca8bc48572239678c25c5cd71802a6a58197d526dbef9cbafb2652a0633e66f42723a380217b7ae2458c76ec1c700bc4f8fdb8dc2bc7759f08553d18934f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c53f1b22a60b098ca1ba34aa265a0ed

SHA1
d227e0950aeebfe66095a28b38ce5223e03d5632

SHA256
b1098125838fcd270fa2551b00acebb126de5f8936ef0297e4644733caa7b69a

SHA512
d16efffc77b4ef3cd01edf315cc3cd9c7b924ac823eb0c03063458a68c5e6e002a187a7943ef28e1a706bbf0f658db026fcd2fe6910c6196b1316c63a1d8c244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9b4e1059ec430c1b7d3d39879e4fb4a

SHA1
59fccc2d05369119d731a02848712db2c3c829b7

SHA256
7c7d2b83614c4eec13e6a946e5881f936e0253501f2dd58c0d09fe5d4b8c9437

SHA512
133c8dcd133d9159817af79993644f7867e74881cef14f63f6a52693d24af5c77481c775911cdef9a452cde50b8f5e40a12b3360768aca36296a05aad0a5c996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edc97968f7183e6e75987ed5fe0f37e1

SHA1
cf8f41c5de0f06e33dafc1be3d472d3e67f1672f

SHA256
8a0645d10ed9be880d9ee6a343285ddfe1381f406b0834b722b95bbbb7d406b5

SHA512
03757b73ce47b6142ced3be5690948ceca0336a42177a516f639f4156dae3cc5dfac202d0f68734950171bced71de00d80dc07736202053e2d65ff6e412252d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
088ac626f4d9c0a77edebad7cd5c2ede

SHA1
ac90acdd7d565296d00e7e393c867c342eecf164

SHA256
24a6bb45940643d7068989829dfaaf2638ecd7d3d0a4a780b4d52e8729604737

SHA512
489f162a631ad7e7867b294466c0ee064350ee3a82ad8921ae036ece8162717a8c6ce0e953e1e0571eb51d9e2434897b815b2724202a1ff75f854e1bdeaa2fc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3a56394bc6f46dbaa285a6da5f0a679

SHA1
eabe4440d7fa979da6451b3f2cacd39804df084e

SHA256
beb0e7650822e268d52cd404b849200867c247374bc24e5b9f392c9423cc06ad

SHA512
2ed39394efafd6e739ea653ef19d79e13ae2e5c0de44a968541f62aa786d9cebb365c782a3beea2dc9c15cb77ecd51829806c23383511a812c024ee76e27c290

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39832f40469d19d54e174f5c6c21e850

SHA1
485de996712632ee5bf2a4b922197a5d74324367

SHA256
01b00bac94f7be9c92715a45dfea0c681162db9a5a900d61bcd4b125aa3ef97d

SHA512
a6d323af25a7d6cafc0eebf3154b87abf0a299023f332ed3537be29b3f5ccc278373972362658cf7ab0ab13f7f66d2a8b108720c8c5c371378d7983a4de462f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3708a052c7b5b3624cfbc300e3c01c8b

SHA1
9b4de9902e11b96e33effe865379ca19b62c64e6

SHA256
00ab558210d94432af7127cf1146e2579b0b80d66816aaf0cd092b271cf53edc

SHA512
77415fa5e4e3a936fe38f01a8c9421f710b3470d84edafb36ea8ebeebff1ad1e8c42fc62f711266f8522855432570851ca3996daf9ac2296419fe20601beef85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d0eff3a37197f7681e44c5496c1ecf3

SHA1
56b00affbe12f30cb6ec502f0986da8a4ca0d5a0

SHA256
f1c9dd568df2e9de9f99d91666e016f951fccdc11c0b768d623349aea786b4fd

SHA512
7979a88f1fb1213cf036d2eb3d8f65d78b5fb0841e70b5f91c2bf6525c512a935d4936dc78d76cf24ab20946c520dccdfb7afd18e82bc8e1cd4f2d500d835dbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a84ead919a28d0b4ec6691da4fd2e34

SHA1
d5380864239e65760e1fc2a44b22cb29ab00cc55

SHA256
1a5b46779f3f26b52737e322d1ccaa2a4c8f4d066d3676d4cf2d9186c56d8d87

SHA512
776883865ed94c8f884d9a7d10a2daf0078c3884ad099a9298815cd2ec13c98ebfd2b3752825f8e6769e124eb4aeb0ceade0d5e8c5693148bd441395f5d8e34b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe9c25229583a7f0f875965c657c68b3

SHA1
369d38dd5c02870ef78bd5cb043a494d8f36641a

SHA256
e0e09211b8aef7b7779e27d9279ce75966806599a126b3bf3c7c91c814d7df26

SHA512
06fa56badf272b48e7f3c35a2f3431716a3413e64a43a79e7f414bd81255e4a40f80b02e30e8b335af8af5997aac1fd11efaf8b123f706e7a1099605d6d2d190

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab46B2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar46B6.tmp

Filesize
93KB

MD5
ac61eaa48255890d137c13baaf731c5f

SHA1
f9ae28f6c21358660ec40239618f6ef9f6b333d7

SHA256
a1535f48249efcf97d37e825a27275a4e0d7e4ac51bceb4ff1262956c6e48c2a

SHA512
e36257b46ed34c2ee03231464ec70d889d35ea9f7f9255ea8bdb062838df8a4331fb6e8808bcf52323e4c26d6c6e9be8af4babdada794495237fd51f75b79449

Download Submit