e8a30447eab1e9d8221a3a012f8d22caa1d62a6ab33a6180bf48f2037117f9fa

Analysis

max time kernel
117s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65187d822febb75845678d4a1e5d7910.html
Size

53KB
MD5

65187d822febb75845678d4a1e5d7910
SHA1

395ff93761ed1c78f4f76871fd37db6800d705df
SHA256

e8a30447eab1e9d8221a3a012f8d22caa1d62a6ab33a6180bf48f2037117f9fa
SHA512

23136d7c16dfc8dceda261a3c6f882a6dcf2850cb00c9516cb141efe08aeb2d6ac601f3a983f96cee1d00f951915d5b2aa230673954db450e8a4d9b93a5c9035
SSDEEP

1536:CkgUiIakTqGivi+PyUErunlYt63Nj+q5VyvR0w2AzTICbb2oW/t9M/dNwIUTDmDC:CkgUiIakTqGivi+PyUErunlYt63Nj+qN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000f752e161d68af0070eac272d1906309bd2b53dc2f03218635ff39fca4a91358c000000000e8000000002000020000000a383dcb24f270765d6b10e8554ba451bad25cdc70da30d1809866e789713ef912000000017279a9950de0ee2dbf39172151e872ca5638b352025c644993cf6abace0b4a9400000009802105c2ca855582dea33f8716624d3402f7a3b2caabd7957b64c8760caf20f07f37a34ddfc7d1986213d7c94307e85f72cf25df957caea80d26d6d577741c5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000fbb330f8ab7f00cb53da5d369f749c2c77e0e9f51c53c4ae010bc4d5c1f3eefb000000000e8000000002000020000000e16b4a4aff5c17ba842fad2eaf4c87a860ff1267ca29640cb35ea7d10454374a90000000d4f8e8cd39d6efeb95be3ce31791185ad698f8b9321d8749ba896686fc7011636652bc7eaee7599bd0d72a8fcad6d03928464f5a9ffd53e5b3a9727c48a77e3afe877243db282a0045a3f67f8962b60584d9c2fd3571b7621f8efe5da0eb2ef859aaffbb791acd25ecbedb3f2e7ca60aac2fae1809f59305d3166e6f75161bd9da5c9cb471187cc2671f9f371861db474000000064f3ffb7c4571b6db9e95df26cb13e346b4aef2118fd0f4ed883695ffa6bc14b13a5b3de18b3a9a3e2109b025278fdb6175e139eb9d7b392b879438a84dff1fb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7717B51-A4D7-11EE-8FC2-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05a3fd1e438da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409857649"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2144	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2144	iexplore.exe
2144	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 3044	2144	iexplore.exe	28
PID 2144 wrote to memory of 3044	2144	iexplore.exe	28
PID 2144 wrote to memory of 3044	2144	iexplore.exe	28
PID 2144 wrote to memory of 3044	2144	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65187d822febb75845678d4a1e5d7910.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3f44521ff2c61e384f68f725b6fed6e

SHA1
c9a5c0dc1287d6808fdf70a552962f4adb9e87ea

SHA256
b948516e57ab99bde863c536567a7ca0fe85c2eb49fca5378826cd8d29536985

SHA512
f60993be2aa3c6c9c7f59066e4211f0c114cfe7392449dc6fb5dcefc2905122c4bf1bd1bb12a33749850cb83b85a83ac34af49447158967cd3ed8be8581c09c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e23cbd357caf495a877ddf39694106c

SHA1
bf6183759d9c90260c2dfa59318eddcdc0c3521d

SHA256
b1c4070970dfd90b9927afde653b065e05fc401fdd7ae2712859719f4e2905b2

SHA512
9714c5128d0251f5c43c1dcf521cd459e91c5217d5c57ce8feccb4d0d6a16b48c75cc3a11388b9f66781aefa5f206fc232ef3412c3894053f37542b57cd45314

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d04da5a6d65ccef4d4e5f801e3e7173b

SHA1
d4e5d65e9c4e556a5682a7a2422d561c6a3eab7c

SHA256
a5624416cd53b8340f959d5a1ee4dee5347cd751a571e37622f06193a93911de

SHA512
066de1c3b3138e6637a7650bbe26deb206863a998e9407aaec756e57153196e3b0d6c7be81f82ac4e70c0ea185f93092a6c6d047bcac06cb257e509027c8e6ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f4f3162b669bc01f7f74c6003880b97

SHA1
8d90023fd63f5322af9d589d441f4562c6fe11df

SHA256
5d771b18048a149c83eec513f484672944c5e5c60677a515c7649df7cd5f3493

SHA512
2d23e0cbce0674f910c7a1a5be10584ea01b4d26b17a00c17feeef064ccc032d437d5b588b2687ab106a93fae0e7d64fb642d2a6d47956be139ed65abc7f7b29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f02d1fc98b73b092de7353caf21fb631

SHA1
debdc4330407ea9afbd3974118d1a3493d75c6d0

SHA256
71c6297ada94c92160a55f5b5eab4bb8166026e7da0e90ee3697625a8ac5f40b

SHA512
c1ec2e8a64c4c895cdb02cf4f0ff0c9e813419d19e2876417cf653c7928c617ce30b002fe6a9d134bfb207623beca57cbf1e97a3a52aca6a6d5cfaaa8c89522c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7100d0fe82db2333059351ac33ef69d

SHA1
2ca87058968d382bfe630680b3ad169f4091430f

SHA256
27d6b68e5ca44b831f66f5876db992228f5f86b250f7564766e8ca3e75057cc7

SHA512
4afeb8dd9aff8998ea32b4b43821f96c9f8939a44698fefdb026ffd2628defdf27ee013762078eb9c6beea39cbe72088942219267e12b51be6b86824c346bed1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c4145f5f332ba4b200f9ce9cfd480a8

SHA1
09c96e0b2707516a0dadaa37f11492fe5c815a2d

SHA256
5e4847bbed698740cf7e4a336490abd39832f899ae7ade4e1b6458a9aaf62a57

SHA512
57440b441d9a56e35b39c304df8841982262b2778ed95080d14e780011d1d74a8019e5f204b176c5a0cb3899cc1275c4a652871f1f0dafb4adc15269a5788198

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d160f3fc04b724839152e555608b28c

SHA1
454d11afc8a74674b693fa7d7d0c80b85f978359

SHA256
876eb6ee7246bf452eb603162e5c0187ab42a2c0d6f55c35ccc1e3f7ece0bb57

SHA512
c29214d7704ace8af174cdb7d57dce53afe0a67f7d63eaa37140a587149ebf02c771de7c17756dcc8e55e5180b43fd8e299d7d4fda7e9f2d6ac8057fab5b1ce4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7435e3120c97335ac3964372c9eecab8

SHA1
5a8f010122cf0576cbb6da5de7f52d6b719a3ce3

SHA256
31a9f2cc059aea5203f756ea72d99a446d1b5ac7ab7573aa97fc51da4e57cf94

SHA512
8a645c0ce0a30e7ec0e128dc681192ea1bcf53e829b3166acb510a5d903b4ba339747e9eb11fc638ac274bde5de57bfcf818414b7adc91b3448e99bf6d08c9bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\upshrink[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB204.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB6C7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit