e16690adc2511bb5c2d998a5d748a184d8f5f5566cf0ff7158554898525096b9

Analysis

max time kernel
119s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64e77062e21b802424da4027b5681c6f.html
Size

10KB
MD5

64e77062e21b802424da4027b5681c6f
SHA1

2e52edb01dd20543eaa8e8a9ccde1375e0478167
SHA256

e16690adc2511bb5c2d998a5d748a184d8f5f5566cf0ff7158554898525096b9
SHA512

30f76921a1cb6e4f0cd13ecbf6ce5a1f6620c636f88a9f4174e6ce56b0ebcad9e70a382637370147514f66e1b0ab7b26b36eb112ead77fe8d75ff5de90c04ae2
SSDEEP

96:uzVs+ux7nzLLY1k9o84d12ef7CSTUcGT/kbipppL1UqptIUFA7lVHcEZ7ru7f:csz7nzAYS/tkppZnIeoPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409857279"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D23FBD1-A4D7-11EE-B36A-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000000d73a1731d125c66672c22742ef49538b2269746ee22b79c9dfb962dcf7efd2c000000000e80000000020000200000006b09217136e95f1e115dedd92180d8eda251d98b32066a6a922b1303bbd8548690000000b4a9e8e1b915e4181f932b414f30b406222c5147267bf556589bc6a8372debf4a47a914f0172df384f8a9a12d25c898a409330d046b2644d1fdb8aab8b2af89869d81ce09f22aafab03f545b5d87391bfe3759314273d6e607d8840d9364b0b51906f77116dd43d105596645644efd7a2673ba599f1acc586b6b4b24567d9098c708e537070bad2582d6cdd8bd6b1c5e40000000c89b4ee72a5b5850985b42b3c6ff3bd3e317444de66177600e0f34fa59f4984978e96bd06eee2e31a2ee2460dcb6f2cafb77fbde2fd62e1f5f083f30d76d1fc0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000007daf1940f99543f5b65397615ca50b390f40462a995b25202cfea58726f91ee1000000000e800000000200002000000055f08cd984f57c496b4d656b68657e46002554c7383c89ed990e51346afefdb6200000003e46d9a13c5a9ec58cd8c8e52dddafd2a7e1369c4b949b00adc50ccbd18b14e1400000003c078a0563643996e14c4d0ae2f027c7b64c147cef2dbc857bb45cbbdc441ad78f2d4d7dbe5ed999cdfdca672a63dd836d642d15916aa2b4ac073183f625ad65	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10282de3e338da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2732	2184	iexplore.exe	28
PID 2184 wrote to memory of 2732	2184	iexplore.exe	28
PID 2184 wrote to memory of 2732	2184	iexplore.exe	28
PID 2184 wrote to memory of 2732	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64e77062e21b802424da4027b5681c6f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2f3220061ab36c2d15c18771dfa555c

SHA1
6a23ba7e612ea413cf965f2277e3f95bdef945dc

SHA256
0bacaa157f92a46bfeddad0f08df61d0a823e4084238b2da857cbcac38793b76

SHA512
31824b6cb4d1dc0c62e77bb2fe867912b9a942c1fa616c54df4e966c254f4504948e1625b17dcd7670d19e192cb3fb8b0bf22c5866c0e7f0a6433773c93894c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1614eff13b50ff2c2e5947cd080cef8b

SHA1
c3a74f0c3ea102f921d75d1f3f735609a70954b4

SHA256
93e5e538eb49c0f100cd1a0da0c87ba2f07ef7d162a3b0e7cf352a566e9907d3

SHA512
0c7e384b988e3888f1c12aeaf0b9dbd9b2cf3b7dc44694092f17001d057cd7dc80249ad8080e968d5de7993c38afd24650c2283a25b3981de437f1662cf81f98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55657a38cb42b3116d935450fc03a113

SHA1
58b92d941bae9eb84efdcba4ea37fa0125cdcd54

SHA256
736f0b39fd4f389859e22dc65c5fc931a9e2b875863ca4c76dc0fec6eece3540

SHA512
cee228936b32c95f286ad49065f98de8e963e0e50c77ce0ba9757ccb5e0d691f93445a6352a74c34450e023ac8cf5e1bdd5068c9dbaccb8ac064b9556f8c5e93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aaf03be044d905cda30d24fa271dce01

SHA1
8bc7c06c0923559e1ae4575338ceff88a21a6676

SHA256
7786d240f139f6affc3962b4781b057361c20c7d1e27b3fe70e02f47f0c97e45

SHA512
74df5ba54ec3d27e3266f0b87bf9ee978049a3af9ec4d46d125df6356c38bb9ecdd8a538077ba9b33e38b9f8525269dec199a59387ca0f21c880d8beecd3059d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3b4917ed0898dfc11d3231d472a1a0f

SHA1
7e8d9b19d32980a364bc76a8f17b18fc80cd5e36

SHA256
4cdaf43d588ebc2034f88e8f11ec924c7130f78630247677094770b7367a526f

SHA512
7de30eaddf62b59242e136fc773a86762e02d7fb4ac987507932f940d3fa587790afe3f95b039f1e6baebb5d544a3720c90e699d620b36cd835b5a2bdce60bb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccc000a560e736546062f28ddc44021c

SHA1
b9174ffe1da4bb6878a9d91fa74ab72263821227

SHA256
de4cd9f940faabc34b8506e4a843794003c1ec5bfeba0e7faf37bec33c3d7ff7

SHA512
f1dd922a5f9e27d5612ad6de6682fd72c5350215f73316fe381c680b94e60ffe443869fd645dfdd6af78ca5bd37e912b4b4d77a2d64384091c91a12f04711a7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39e03be3599826a94eefc2e2c1faa520

SHA1
608990f49cfeb78f95b84c5d249943ba785fe12a

SHA256
f3e3432c8d3312195bbabd432ab1436b357b76d6ff8f74f86989940daf9f40d8

SHA512
bab906f04b9c62bf4c40235279789c60cc5c69f23ab5ee34ac23e963f43abcb437b3db1ef42a0fe1331646664ceb6de2b44069296515deb42355d9c4f23064df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a070e5084eb9fac6ac9562eadb9c2ab

SHA1
9b3308e4362a70700b007527ab1af1f40959e8b3

SHA256
997721e01d3f642ebcd2d112e94ca1c37b71556a88c8d832344f8cf9257311fd

SHA512
cc4862f38a143f9bbb04848b305c4ab3b2292b6694e4c5da6e895b0ef884439ffa9f746a6b58cb36fe3e8f769873629ff58e80ebace6aa0f4768fc9631cb27d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ea58dae5b85923ee451c8f7ba840859

SHA1
33bc8bd722f17ed3ace6fc576cb3fd04702d8f1e

SHA256
293f1c03298eca00e525341463fbea46b18ac51a8943002da83a2f6a2bd8086c

SHA512
485bc7e624cf346c538e2bbaa56893bc135078ef724937f0dcecb3f9bd871f0293ba192fbf0da095cf2d23349c421811492fad6d70d7df619095cb5bc3dfb6b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14d3b5b7906a432fff28ba587644ba14

SHA1
42dd91cc1e07eb1241026bb99feae71379be1664

SHA256
bd9c9e5ae20ec80f76ec733febab633605c7b6e98fdccb5351197d5e9287b567

SHA512
69cd65e6580ae4c99a73d89ab94961a1ad052a2fd913826f285bbf8f66f8ef51af63b9f7c2c1cbfb7e707a6d4e4ffa4a7e43c49ce1431e96eca709d1c2484eef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d480aadbe78e8bae67bc831890e21cc5

SHA1
5a4a148e5e2aec5c62d92c534bbaf2c1ffa42feb

SHA256
2ee000da4f1b4a3701a2fc63284fc362a781b9fd2650306d5d1b0b0a55be8b10

SHA512
1596fbe10025915457a76447bdc8a967c92c54bf4c659e3ddb09fcab222943ef63d54f386ef5cb8a749af4e74915d7c92914581ea5780c29f650e83becbc223c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b860737eb4225b8021e83df12c2f5b74

SHA1
b1091f4e82e8acf84bebcff2f55c83b56b88a951

SHA256
6efc55ef23a632f28f9a9daa9eb16c3aa5de11c9d574fa8f4eb902eefd478758

SHA512
41ceeac8a10c04b8867a6e7f6743e59adc119500a556f669294e0ecb78c9c8af16411bbadb181385819e2f089f9d29d4dc92707c3f5a3d4333b1870ada943fa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35c26e0799f47d88e4d7e6a427a1a0c3

SHA1
12c088337f988640dc8bc9a477cb1ba34f446f4b

SHA256
a9e33b750a4f3ec6ec883e1c8fae4ddf62d13dc81a7ad5f779b304f318d2a19c

SHA512
b74237998ac0409bf9b0c803d6ab7f3828c63df2de3a53997df78d6f717d8f842d4c0a85ceab560133728098c42ccd5ed0fe3b080849f2729ea87d17cc89ce72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47665634424412c56e274217f84d3a86

SHA1
229a569a568b9fc687496846e1dbdb19983d6ae9

SHA256
052466a712c489208d51cb426e5357982871fc6c886faa8f84f866f04ce21ea6

SHA512
1c061891c346a65b0e18ee7b3996f837671017c9eee076c2525702786489ba0adb992acfe4964748c2df8842a330ffb6f3ab8d68c4afa94934d9fbef7a6500fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f21c64353b4aed4524c5f40f71a7aae8

SHA1
5a6450527b4ffead02a3d3a5590423f99cc9cdde

SHA256
a5b495df5f3dd6de1a229f0df870105339c8f8bf27ef2328f382a9c2887de1aa

SHA512
684dd7f43c8ac42f5e24d79f166303e3a2c35a5d6de691d782e600a65008a531d17f9bbcbb80257dc6085e6734dd0d95eebbb7342baa8d6550a81022a88437c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5F60.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FF1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit