e2802b1d8c5a29fb2a6f820bfb865dc8e45aa1c0aed2c63812ca7892a399b504

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61c7f975f7d1addae23752d94aeef644.html
Size

53KB
MD5

61c7f975f7d1addae23752d94aeef644
SHA1

b8780217884d27ef7322df7c5cfd6fc629fc9bd5
SHA256

e2802b1d8c5a29fb2a6f820bfb865dc8e45aa1c0aed2c63812ca7892a399b504
SHA512

96169d1aa99cddde774c4930d935ef376579bab2432df57677c8507dc5135a12701d5b63cd3d4f076871e746a5e44967ab6b9f64c959322df0887dc5b2004819
SSDEEP

1536:CkgUiIakTqGivi+PyU+runlYh63Nj+q5VyvR0w2AzTICbbEoq/t9M/dNwIUTDmDr:CkgUiIakTqGivi+PyU+runlYh63Nj+qu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000690ddb2747f9754ddfcd2626a1c760a96e056d0b4abc2b0b639baed7962f988a000000000e8000000002000020000000696b16e2add3207d3e84f9b6643455577a0a86632a3efdc1f2820c968344579020000000b3c6c3758d07d88a91f8e074e968d0c24b9f0a8f4fa934ae7554b874248b96f2400000004c7b6fa7dae22d64250f8173dde91c971ba8c42ed7053de66f2e66b19800b2f52521d99a849e42f19b80591902891620dbbfdd6d2b8e0f6e3da6950bd5308cdb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000f65919690849e3010cc4f3a0f45c9e9e988b35e9151c92fe2bf8e4491f4e4673000000000e8000000002000020000000ee3af6838ac562cd3e11790090480cb4b33e95044d3492186535313ff58a5a6190000000664d06d5fb588f19257fc35767ed3cab7139f9aa9657ac62486b36c81729f0a1cb2831e862f24d6b10f13e7a85a1a604f1588eac099ac7ea0e3781e34494f4aa77e5c51798e6116be382838cf3daf1ce31c8b706d9467733a2e1980a5a243cc1228b747864f6d08c4b12c09cf1c4c525ecd33abf776794ab6c8e97bb7648a3bce7de35a4c63563dc1e1287fe43155f504000000060b25e57d12eed572fa51d23c7b775122ccca8d975dd892baac0035d3a99c8f6fdfde793cd450219414899f521ffaec791b16327ae28fcce5b0d5bc6f7b13692	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A756801-AC64-11EE-AB16-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410687588"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a024e02c7140da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2340	2080	iexplore.exe	28
PID 2080 wrote to memory of 2340	2080	iexplore.exe	28
PID 2080 wrote to memory of 2340	2080	iexplore.exe	28
PID 2080 wrote to memory of 2340	2080	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\61c7f975f7d1addae23752d94aeef644.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2236e04d5092b4b836375a1daf3a231

SHA1
339f5139d08be52a977ef3cb13ec7864dc1d0853

SHA256
db09615975b72ef3c262cd0cd5e637157a4cdf7df402f70dac01526982680b5d

SHA512
6dc8651654bca1572fd626692f3db6a2937285c02c3ee011b84e25afd33c2fafb82c89233fbd5d91f2b2535ab44869e407ff822da61526adabcc233670a389a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3dea5066d3e1c03c32f71a6352889d5

SHA1
5513c37d4110f887d2877681c06cc2a0a0bc3abb

SHA256
14bc897fa5531df20359d4e27da5a9e08a4624225a8bb286b5294a9eaef23f64

SHA512
46c5b7dd9b83374e28614310b95d10ed8c1caf212e3d0d47465dfc801d91d006781538ff086b7726050c52d8b62f1de2a0fb6125c038d72ce4cbc4e7d6040473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9374a367bb357cb881391165846699fe

SHA1
5f526bd1acd1ef3659e82b59a01b07abc66e443f

SHA256
89779c20665432233fc66e9a55ac6dd369530e29e41d1e7b79f777c79a9088df

SHA512
61e1cf95c0d8ec7069302b3d3870799437fa6ac381ed2ffff5db691fb46e4cfbb13e4d9c6f0d1344e825ceda1c41d3de92fca8c236e3760c8972d16685839c9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f06ea9ce8c4c29ce5a2b2d9bba1a96c3

SHA1
58714dc3b9c0d813b0cd7122796f02546fb32cf7

SHA256
81b7c00960481b616af0889a727354fb058ebea8bab2ae246d7188824d03af89

SHA512
1e31029af521a6d1380b64dc5712a65758fba94fd077e36c5b3d01a14b8e4509b381af7f7bd968f5facffd588e280a9383254981659b5259c35e1321ba3d0cc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6415647960c409ad7b6cf03f3761d81a

SHA1
a7cd7938173a49bcf1612433ce1352565ba91089

SHA256
3b3921c41e5a887feeb1edec4db14e246da37feb0ba3d6755a33880d945117e9

SHA512
86ec4e2926e196549b8f0779a4b923640d7c98f9776c2333b037d2edcaee9bbbdbc349563fb951fcd7503001eb17c945f5fcb33019afaeb002d3793ed0ed5485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ce4c9748966cd596ec803085f2deb41

SHA1
9358e0afcffde8ef84ec74bb51f0377559393a37

SHA256
8b0a4b8a3e8cb753680ca3dc71eac23d019482d285c5659093244e2a927f3228

SHA512
730ec0989ece25b1f777da3164001f4bfa9c59891950af2adfabd899a18d11178234f55889518f49b3786bb735801601ae60c4cbfda3b6660b02a0de4482a153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79286c6fa9a408405866edf90a5b959b

SHA1
b0972b2808eba73848e12abf800e4355c83aafa6

SHA256
0205a6d1934efbe496a59c689a236fdf138f6d8c2e8fbce3474f2c376a75e343

SHA512
b3e8d89265ef4e234f625a07576bc69e71f4b71c68f03d99c20da99ad9f86a6275861c904c1e9ef15ce13d1071083e1996fe3b757be46d8a6de95712b16fc17e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
607a1c16922cb6d4e7e12c7aca646c6b

SHA1
1d02a5e2018ae74b06bd24fc1004802c25711eda

SHA256
c0db84887f829dba7b8633a8056fe2ec00e2d73cecdab7bb16d5948ea235f7b4

SHA512
8567ebfd39063c799538b31754950b46114db5373c1d0fd29f6e548bc0d57ed57b197943ce7c1abf983846e7d1a8116a4907805d5283cf89f01387a5d5c90586

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8279d12a4a29208b8e22b39f9960c63e

SHA1
43d30bee7d6883c70943ce3ff7a409bc7f184665

SHA256
7f3d7e7d3d9edb666eb72e2461450e2713e7cba88b62ce8d724c998172c23361

SHA512
fc3ce4eb079ef6eb3631b28d97a5e2e3a47e06a69aff9608c2e9d98a61e880f63f320ff9d45786d62c7085901bbabb29a0c05d86eb35af14f9871a53b0844f79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e91a4e95cf8ebb735e80bf85915fec9

SHA1
4ecc67c8e23348bcf365adf9763fc406492cf9d6

SHA256
8640723464a0a99276356bf7689a1888e770b64a0cb2b55e23c924795fb629de

SHA512
3081b40e6f9200a2f6f6eb9a0868889363abfba9ae9a997607d4e95be5f43b8c1a8394fd5e15fe27c57d8ad1eec128d3e7049185f652615991ba15e07a8dcd58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2333e1ee73f2a044e91a257334002ad3

SHA1
6064be2528f715ae656022a5c05bc893362dbf74

SHA256
d6e797a769b2da13032088a4506a2d3f0591c2240bd428b40d1848db854f7541

SHA512
b314b4bdca9b33a1c40ac8121b655fd21e0dfeeb3e4a1a435f5262d7797ba1cd8da91f2653b35f6becf77020f10852e2056bed53329a4eafd7bb197105341e71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dfc7bd19a593f58118e7042cc9f0c46

SHA1
e98a71f7bbe04b6c5880fade261c3939d47e0c5d

SHA256
339c023e2a7669fce37906580f89657e2591e6f427fffb82c46e7673919fbd54

SHA512
ad603678e2e3ce59a4c5fe14e526ca74271dc0c636233bc15eae13cb36b2e712c1bef3eae40d5381b6568e62adb7b2e61980ef4102b2cd3b190fb73d8cfc9c9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
582b2a463a0fd32251d1f30026f38f9d

SHA1
63398ea93154fbb10845c801769673605077a10d

SHA256
690a1db1784c899439639f398fdffe043892b0d79f882d10aeaed57b1e11c28e

SHA512
56f0f1b73313044c675d0c4d8fc6547471bd9cd530a07f390927c94b1dce9d5e5b452e01a07a8bb270f832596e2ea62380e6484e2299a7715c508059d872b33d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40a3dfa35df98871ec04e19a8d90a950

SHA1
6e66512ff7ef0628ab1cd6afc5df05d531b120a8

SHA256
a8a9ce9c5b0d04bd020f45553b666a6ab268cf774336366be43df251f367f6cb

SHA512
6b8492412c7c292a84660ec4439f718979fdbb3438c507828d81a9ee9d86125cd6e1969b18565ce2a060cbcedc96625ce782db66013b5aa670b394d96401f40a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68efe7cd2ef00972a3e192cefc3a8c2d

SHA1
9835fe9d65893982a72d1b6b4e2e8c238a692d50

SHA256
60ef4740177e8622c2344e86e0020dcf8babe90e5be4b43e30b7bbfcacf5276e

SHA512
2ce6e1b8d97098906fe35e78f0e52b14d074c4552ddc31d77bd9558f0e29cd2af3930a7d2131eab784a67fae50b782f134d34c36a53594c4c19447742a71e2de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31d0ad9fc82107b375ee17b8f1fa8099

SHA1
dd0bbda04fa7209a43908d0c2faf778791b137dd

SHA256
218f9c7132e9d4e691b277b30857e66b4932f1941e8804dd43168e3f148d1563

SHA512
c696b8a71f1f9d4d06d2adeda865fcb7663089f42dd4d6d9488b43fa55734ec324d37c41b965069954cef46bc1bec1c91217ad52afca06ac71cd406955fb5280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1EBDLS6\sha1[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3749.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar43DA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit