e6f78a726b365f620275529ab2c52ca5da2e9508de42369410f152cb3143f4f6

Analysis

max time kernel
145s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AppFiles/HTMLClipperTemplate.htm
Size

187B
MD5

09cd6ca091ff48d3fed5ddc6e263ceaa
SHA1

4801d05f4ba31d37c4650400764394c480c537b5
SHA256

d929a65d0c691db12a1357ba95ca88620390fce8a602151f0ef77eb9cfb2ac5f
SHA512

64afee02617efc80cd0fc6cc392111eecffad6226d74fb62fedce491771de7bdda432f044f22b5912c8a8da8259526aa5276056bd3cb9e586a90ec7243cd6028

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000044a720dd379b7b153d8bf91f95e3aebe02e50cbc5aaa592361f03faa8b5ccd0d000000000e800000000200002000000088c19426f51c592f2bed33b8aba07ca62fbbe3d8de5e9300e784dc9297a6c1a0200000006adbffacaa778164a4fd9387d37b8e73cb8e2b0aa2c85bba7089902d3d1ff8d3400000003403798e98d11c28a6bda2d054f77c4ad2c966b157ee318ee8a2fa2d0c7a66efce5f0bb8af65a65caa678666caf546301044cc8339113896ce651611dfa6ef5c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000152132f924c5fa38a1dd9202d26e956c98dca3113956cb155aa5613f097263dd000000000e80000000020000200000005a94b079b3bb7c9ce2758a896e8186bb633e8ffed614200b2683248a23d1b1c0900000003ea3ac03559c6007326201cb2b0578219ee07af289755f58fca293ab9c3fa12132c366baffeecb737f8218f9cd11876a9ab528a0f16baad8a4da6c5cb0192a61e58d6a351cb2000b26a196bcd0581ce08277e92aa58d1b2740de39f1e77056d936ea9a6b962e7142f4017e4ba68b87c8110e6433f0c2a5be6d2b7f20621f42a6f50350a745e17203108d911d3572403a40000000144354506b6a5a0f0446e41414e6c88e205bf877f7e813a3cad1d5bb3930630e30d8a20fbae7205d63fbbbe5d3ea2bbde1046c6db9158c99f98379fa8b52a9f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20229f5b8340da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410695423"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80038201-AC76-11EE-A20D-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1104	iexplore.exe
1104	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 2716	1104	iexplore.exe	19
PID 1104 wrote to memory of 2716	1104	iexplore.exe	19
PID 1104 wrote to memory of 2716	1104	iexplore.exe	19
PID 1104 wrote to memory of 2716	1104	iexplore.exe	19

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\AppFiles\HTMLClipperTemplate.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4e350f34eacf434a5286547a7b3a9b9

SHA1
a6300cfd49a7a3adbac3b9bc96ac8d609602a42f

SHA256
38edd8fe1061095a0c49dd559519cc7cbbb9f98172c7a7f1aad1c682cdf0b01f

SHA512
646737589d034c61ccdaeaf55241469462e725fbbe49cdbe299a0392950c3faa9ad5dbea3ffeaa29e71e063853ff5e8c098fc57197e24d4cd90017c0f4fb1046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0ddbf376f452eacc600726ffe2bfffa

SHA1
d871495b1a9548f1f51864573dbef94b901373d7

SHA256
8b1764f84a141fe051a9d323bdb4b7b630e838cf8af6c3217ddddc28b6f08fba

SHA512
f8410d5572aa805109988e44e5d4506671f647352bd423fc23ee64195628e5d0005017424ebee9a5c0096f0031e37abacd8c8d415017c2298c8cfc5a2bde72fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3ec77f272109ad4ba71f72cee1525ef

SHA1
cec0a9ccd17587e3560cfe3970c18f58fdcd9487

SHA256
365f73dd881c6ae9fe2f75db67ddbbab9d0b6ed0fe8a0e2881bf3cd20ccf89b3

SHA512
cfe50d324f13ca90053eaea22977dd06a1464e2dced698c028e91176fe80ea62ed24869ef3f5aeb14b0ac3fec0549892610721efcf178a1815ca9042ba4fb0f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8626c45b8e5c7d10c66a1edeca576ed7

SHA1
4140c5c601b4bd7cd1e0982da20a786201a712ba

SHA256
c4039312be8db42c4280e6cc1a88519ab81e7688a5594474c66a71e867b31197

SHA512
a741a251bbb0988e1849b6c07f28af2e0b447e9fe323e5469dd6953b23c9e97748aedf37c1ca3161757bd01ce405b580815186f1fc536d9bc71588c2090545c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4f75ead1bde0bcde1cdf3c04748c668

SHA1
1f6766e9804dd23a8d215022ed449689535af349

SHA256
bce9ea8575c382d0404c8adcccea9c632c3dfc8572dad8cba78aeeb817b42ad3

SHA512
bb717eb40dc739663c4433a92f3c5d2f9e73df85603db88ce3d6a68b4284203176309bde6f4ac961dc183dfe8637e4cb029b28b9d0084aa0d4096b0f31a99d4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b4bcca0a24a71ebc8bb4ed53faf958e

SHA1
0c1bee5636df46035b5f1d232efbb101594d85f6

SHA256
619d3aeb0f55544c10c4f73263bb68b62ec15f1a3c04ac984f09945d206023d7

SHA512
37509a570cb736e0c7ee77a61baa56dec84162d342fa174b0594dec1486512814c83e4b3d0ea153b607f82d54982e43725876d77e3be126ac4c2876f21b9941d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02d1c97a9f551def74b6192464b03e71

SHA1
f159b8933cf13778c2f4286c7ee409add773a476

SHA256
68f75a030c672abb151ee71765c698a95d3d73c91d717c3bc06f3364dc927dab

SHA512
e90b201e7364f899bc7dfd285e843635a2e6460543bd635d48d84de489a97c3e7ffbeee2f2dbfdde43581c8b9e86765c0ae0e6b28d1bd330366fa3c2524e2d20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8d8abc9e3113112ad02f435215ab2d5

SHA1
e8adae8bfd44e83eb0973d64b539e0850d3c305b

SHA256
665e1d1e78527bfb0860855596eec0fa777b1cc9b366c639d49b3aa769ed99e7

SHA512
fcced40a4fede920f2b1a511baa54f01f8d8d7ae2a782616f02738f6b91879e7970a5acda0e053dfb2fe4834e7193aa23936dcb19fead6756c386480a8d032f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac4902c66b489bae875019cfa2f247d9

SHA1
67a729f8a414447f3ef5430b268134afb710f49d

SHA256
20247330647e28610fff47d296f06fe150df74cfa1f0aa84f205aabf250de7a9

SHA512
50778ab427114dd60100050d16b18dad10ffffb113df13bdb18e9fc571f480a603a9e1d0f6891d80db8da5ef14dbf981fbdc34be89d1a38071974367fe3f44dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4223cce440ec1b959bf79678d112f952

SHA1
6fc04b19f0abb6b9c267bceb980b53e036677c45

SHA256
a266c40ecac6041659944460b3e7223a7ea157bc468155c6942d254f694b3233

SHA512
d2dd7bc89a2c020685e030ba6e407c03598498da097c8a4d863263472055e4049a8d2928e73b5e3da016ebc6f1527b0f2fd90303c67a3c71fffc752bd82237f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62efd5e35897f250a0d1aa5402d0de62

SHA1
d7c60ba72d61be78ab487e8468aa7f60037d607e

SHA256
f401c8c8fb1e4035d16c16e5444fbb37ccacbd17e17f1e4eba1ed1c9f3129744

SHA512
f3adab6ac72d7eb503135b2c08f4c3b397c18adb760d53021050399f0d63bc81a4e5ed95c1a83ea54a86a4cb67db44f448148daff50f2aa6c4db0d32a75a753d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab377242cf53ec858bcfb3427417945e

SHA1
25112d01c500b1d8e58786962e3629c495f8db02

SHA256
40d38651c5f015857dbdce75172ad4688c0f67360ff4ee90716cb4b388e24bb9

SHA512
c51442f551d0fe4dedf42fc16163550544802cb62f640ca9abcf723324aae37ca7b0b88cac943adf3925f57ff956ad9225de3f8dce2c53d5105b3cebe3c182f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e18ab0e81d7ad880f78dda7db13d95df

SHA1
d34bec3691d5d297a4c8be48423289f227732e03

SHA256
3d1eaae77abefbc6894ef29784df43f2d31f15c31d40090af344c910f7a72697

SHA512
9ca265419fce23f94245a0e63758b44dd5c8b8b6072c0cb5eb4cbab48198a6a7c3a4504bf958566c5a154f60be854ab4f2d2997a3ecb8cbb0880aaabe96a7eaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5E39.tmp

Filesize
7KB

MD5
ffde59a372aada902b28d4c3df5e0e72

SHA1
66ead0c577d0f6e8b0676c101d1ad67cd5995af2

SHA256
ca4d6d97cc05070c9a0db69a6f61dad2e30f78b13fd41728ed024f3f710e7a61

SHA512
cb1da343361ae6057211469069a5bbc1bcd8cffc0da73e17007194e446dd94c4e0c2fc211b8896c03704b4c53a136f515a468ac3c410131aa30d215f4e5e80eb

Download Submit