e9a7dfaaf5efed3fa1477579d352301f3aa0a2a8615771524e6e26f59fbeb201

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

64f5cb82d223690f685b0ceeebe12a17.html
Size

53KB
MD5

64f5cb82d223690f685b0ceeebe12a17
SHA1

d8590ccadbfca200b4db23fac9c5c7c7681c2ba4
SHA256

e9a7dfaaf5efed3fa1477579d352301f3aa0a2a8615771524e6e26f59fbeb201
SHA512

075f3b490bd5b49f178ad7ecefc9b683f988cf8aca005cafceb4140837b4669b5bd1c7e1ff9bdac998915b8894c757c0fcd85528438ce3b32d74b563c451de40
SSDEEP

1536:CkgUiIakTqGivi+PyUDrunlYP63Nj+q5VyvR0w2AzTICbbwoE/t9M/dNwIUTDmD1:CkgUiIakTqGivi+PyUDrunlYP63Nj+qS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409857364"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000038a8c727c78c61a0188d8d0c632631d356addc2ea2d392273adbb11ee88994f2000000000e8000000002000020000000cf279b22926e506144fb5df00c7b0479a4ff31fce76a683a232a53718e5c22ce200000006bd2c596e3d7ad17441ba1bbe84dfbb031dac3a07fb5de88103f885ddacf659d400000003b7d673eb7694a21167315b638c485d3b0515fb4f13e0a780b599b21ca80e69dc31ea123c6bbfb22926ea0d89eb2baa86e2b1828d944fa81b595afcbb0ec95be	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 909e0834e438da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000e716e8e37425e080ebc1618ca8181762fbd7cc5626cba30169715ecb2c589b4f000000000e80000000020000200000003ab02084b185c7d302b891657940e482799fcdb1183e204edb0399efa919e96c9000000022e31285edec19e84f171d26bf5234354dfca2e6a8b1b06db1d61d4c212ed744fc9e676cadc1716ce311c077bc76cfe66c703eb5faa6a6b4a9a0dd9d6fd91468b779e67396b3122b286ccebba4a07c3ad2bc9e053f0d2dc175ff0784421b2ef6382a105d5b940a44ed5d365838c99375fb3af4f5322356b97614dece0bee7dd4923aaaf7739e016b394585ab41ca303640000000ef6096f9fe085e2f370ec35f1c40b34f8af3b99e9aab253938e39c7226e2481221c71671360fae43db772626c9df9d177753b1cef1d914163de6477015210303	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42F01411-A4D7-11EE-BE0E-D6882E0F4692} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2932	2140	iexplore.exe	28
PID 2140 wrote to memory of 2932	2140	iexplore.exe	28
PID 2140 wrote to memory of 2932	2140	iexplore.exe	28
PID 2140 wrote to memory of 2932	2140	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64f5cb82d223690f685b0ceeebe12a17.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4f10afbbc1dc75561a20602040aaf13

SHA1
046312a25aadd0b0291ccac48e80938b3daffc66

SHA256
3476d030019288bc14e5aa071aa450456bf70b6b7e4e89091ac3f4b5b14516ae

SHA512
85d6e07c4b3d76191482b4b21a2b8fe4093bb190cc0dae43db90fd4122a8946403b9e59a07545c490baac668fd4a4decdbcacaab7641f2674c6544752c6c4aa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3da6f0789f8728ab421d7991f5fc48e0

SHA1
67192ff8f9fbdbb2d6574730330cc995ce54b761

SHA256
5febbfbf1b93a30db7dde9a196284a4cafc1bfc0d0a6720c3541f41f897cc434

SHA512
33647feb9894e9eee916d275121c2354d13f4c2e4d38666da94e6998895a17a12dbb2edeac087f2e913021f9b17cae075de8b0cc4d219ebc064ed28c808a0f86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97a5929b654adf801ff0e31cc84c55ce

SHA1
d9c7cdaeb8ece6db3369660851246ed423d1460c

SHA256
d4d2372818ba3b56531237484e081c72d2947912f7bd8037425829cd2de46fe7

SHA512
727c3eff5d988e86717ef9822348475ec6288e70b0953017bf43e42012e6fbc83784a207971ac15c4557381e86d7b5cffacf52dbd5e22613b56213f7139fdc71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
132da0f03293c93b36a1a038a3fdda0b

SHA1
88fd195382cb289da47352b778d5cef676f2747a

SHA256
aca49d51b747e3f1fa1617ded3275647598af2d7b9bc1712c4e00de40f71d287

SHA512
aa568ebe5579f7f2614e23a4882db723066ba48960da39569c6245b3968a29f53e4af3f7a3484faec9345dc6e84ca9c65f613147a97c33e09aefd7ffb8cb08b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8192fde86e3669c61655c2aa0d252b7f

SHA1
13a1114604832d3d76b85f1d671269e05c971d48

SHA256
e2dc22d3e945a6917282b00c75c0f9e9878858f19cc9d86e878a27551ea43a63

SHA512
dca9f7d9a84ac786aada7fa9356d80356ea552a3bbf2c9a96657c9523ff132662537c6bdd0800c551d045544d4679f695272529b42bc497354e26af334905fb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7412b0735b598be77e7a0deef5eebba8

SHA1
54d2301ceb76b7978757f860c94bb08f9e2741cd

SHA256
31fd87a10290cc760993e012acb627d706e73a27984be40c30fb230363e48268

SHA512
1b0de9523896527871b43ab7a683ed814ab01801ea57ebfa3dde3c5a1513b1072976729169f933e704a2a251a06c44e3b6279f71eebf8db4e75012faebd66c53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1d8222df264caae212ce75dcdbd75ec

SHA1
94e1eb6c50bafc86817a6aa85efca6aef87a6e86

SHA256
59de585501a759ccbe6e78f094e296e36e7988f654487853eccc0bfe7b7095f2

SHA512
c96f74ba1977b7a391ee95a0c65984fa20591417029e35d60c3157376d3b14bd11cad55df2e422a948f00d852a0f4264443622cf9df34da4e1dfff19e57397af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3c338c730f7a32da5aac0017112f005

SHA1
cf6b97fe1a736a718b5b6c4763e683a4c3b201ca

SHA256
320d519e2c4f857ad8646d2903fa362fd008e4ac7f10c36a9229618b91a7fdb0

SHA512
09fd5c9887f4413ab1eb2c58a79b45715602c788a2daed5096d9d7cc26b3b09a3834d9ec94020ab623de655c5e1d5e364f74fd1675f8c8fe3dbb0093b998a0b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f98e1733f9b4549dc07dbeb6d24d9fc9

SHA1
9acce190fa0817af49d26519afb9cd9608626112

SHA256
a5e032a3ac89863c278a9e95a89f18291aef6d563c7fe928ef43171a764b7ef4

SHA512
3c7dd790471eb2d62f2f853e75168017ce1f68d901400f467764f7f3a7e36627099d36e40173dd088ebae39b287f1f502e2fade7a9c439e82ef62488a29e4e66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c25cf7e5eacc67cbce3fcbcbd954bfdf

SHA1
47d2b02ee7c8d66fe7ba2a96f074da00d0a9e32b

SHA256
85dcbf182dd9dd6973860e5e2c8b6663d632477de924bd80e375cc4befa2cd17

SHA512
21531dbf0ec55c1a3d05a417eaeecc7b840e701e75bd2e678f989ee044f6037350bf121f0c1f5ebc173d0ec787a372af02b4d8a9ff8b2cd40fe6b7f4fbb616bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa974179f723fc978914fc3d37c63154

SHA1
cbf9326ed0d5057bd8366426265a67d70a58f600

SHA256
1724fdb4e99f9e81c9d6ba6ac6429e9108c5a3b99bef347358bee836bf3ba849

SHA512
d698e7de26e235bfdb73154dc2491a9f4748b0b64cb870b64ac2fcd361e6ecfec7e623d0cff9a0b8c7f4c6cd11b3de5fa26e85b1d132cea24ecd32f3c9692784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfbe741cb127e3482c125df24bc64d93

SHA1
53ec556d24024010d7bc9c21ce94c1f6c8cab90a

SHA256
d650133e9a2a3b7b91570620e97679c968a949e9c1854a187a1ac058b9fa2d45

SHA512
b65af22d3046f220593b1c1cdd169e93604456ba1fd012d462ba533e82d4fde8ab1a73a7a306f691a356edab316fa7c0635c664b6bd5a2b24bf58865b161cb21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdad588f28f9dc14b18032e83f809bd0

SHA1
bbcaab5819b09ec83c73ac51f58152d77bcc2db8

SHA256
e8f2fa5362fa84c87111ff2c7a4e2f531323e9ef69033cb1871db1a66b971f1d

SHA512
ab13e37d060eb33d127f6882bd25f19923f8ac8520c67c4d71086cda6e446966039b8bf9800a72f1589fe66cff1e6337df42d878114c1fb3239e115b8850172f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0662ce385850e8f826fbac063259cba7

SHA1
6f6ef692ee418b71088c663c3edeb1a6c68d547b

SHA256
2f1ecae1e0488f3f32a9f43c75dc0544605291fbaba94f004f2d1aff20451aa0

SHA512
1038eeafcc86303c5dcf54d30d60256dd9a60079ff1f1a56a2a8fd75762eed3ac95340dc63339e92b92f95bcdac6ebf9f84bed2f93ca2028eec9f5825cb60731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3F2LH07\print[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEA14.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEAF1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit