efcd6fa7e34e12d9da1669fd69905f807f4896b5a278f85c5b81a9a8d26245ad

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 14:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7702339edd932fd5b1a2a4907a7818fe.html
Size

150KB
MD5

7702339edd932fd5b1a2a4907a7818fe
SHA1

3675716ed4ed439be8e2df5f5d80b6442484df53
SHA256

efcd6fa7e34e12d9da1669fd69905f807f4896b5a278f85c5b81a9a8d26245ad
SHA512

496235376099f727136942eddd8a522b41683e4634c1a2bbfed3ab5b39d48917a7cdb988f28597bb33e0a55bbb2a267458abb04b9e8f07076c86e0fb414b3cb7
SSDEEP

3072:DLUcjvG8rMUcXmNRS7jQr7LGTXdSq8nWXSJDH6:DZGXmNRTuf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000006debfa866a369fc84a437c440a9a53143be30d4bbfe51a7386474f9ac1d83936000000000e800000000200002000000091e8dc1a0d5278f1a5a226364209cd16a4e8157f8486a908726659c901cf598f90000000ea313c867322fb25d8e9f415e5b8bf79ab0f7f1011e2b57723b923a6c0aeffead2c2d07c453b11517f3e86fb14e3310029dacf84cc792b89a95cacc5ef392f17f9defe9685553ef47e305138cc2bc7eddf75ad0e11cfc47951fd864936a2b1918a901ed8b123aae8da4229953b1148cabf664acdd898c36ec0c38c58b152babffe1fe191b67d97b77864f33779850897400000002cfd7e1295ecbf55fee9b405e0237f5fc1fdbb513e205217a56bebbd2df28521732a1c83b04ea1f4a177670e98980e58b0e77115d8e5c7825fa302f0de1e4ca2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30115e033439da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409891683"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B402DF1-A527-11EE-A80E-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000073fc39283245d4aff685a79d0e9aebd92a5bf8ee4bf74fedcfa1f00c285171c0000000000e80000000020000200000007fa45593a5ac0c86005bff53ed397a02802ee9211fbe89c8fe1bab2a8764ed1a200000009360bc23b000417c94bdb33f79b18ddf3428ed107f55b7ac2a46cd4ae6d39036400000001839f3a1672b8064eb949c110ba8e09c392042c12c86d9e3aef0e7aa3554a4309a3421a78407964ef42eac86d5fd47ae18aaa665a03c8c422fccd36a15514138	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1660	iexplore.exe
1660	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2304	1660	iexplore.exe	14
PID 1660 wrote to memory of 2304	1660	iexplore.exe	14
PID 1660 wrote to memory of 2304	1660	iexplore.exe	14
PID 1660 wrote to memory of 2304	1660	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7702339edd932fd5b1a2a4907a7818fe.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ace1807374643ae55fbc96532da8fb89

SHA1
a892376ca11f10303841d7807f109ed6491495b4

SHA256
01b344e6598694df61607d8ad880b678d56351028a95d23b632780f5c4f7839d

SHA512
afa7c3c019edabdf25f0bf2afe42d0ae370f08d3894efefc5f5a832c7b361bd534bfc1d7a3bb45282ecf365f53a3f73a95e79e4ca5e54e0d271012368b191fdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d511f147299c81feb253c721de52fbf

SHA1
b44567d4302ffad803a15f702c7b846b3c6540ff

SHA256
24396a5dd9fbb2e1097110fd8371a0ef6c93d117b2ff4e4ae7740d4061c21517

SHA512
681b4f553f28af10b7a6785da571043a7cac5d9d44bf19d0ef7204c837e6144032f03c024813645e88e45a44ca4a51e5241f51a91b0acdd168740f877aa99db5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
deabf4f5a366cfb8d5a9614fda945288

SHA1
321d2bedc61e8c984633f0b2c43aee20503e0e29

SHA256
a30ee80acd8082b7b322842d14959e035393633c801a212f378d433d8279e18a

SHA512
76813d72725d67ab2f5841d265c99cde4b8642e7690448a601cf33f436dbba3030787377a96252d5c02321003d433de52f5af784689ee3eaea496629cc22980a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f52423c9cbbb3b6119e655a5edbfd01

SHA1
9bf73d639cd5c75cceba652b2c6430e379189e98

SHA256
571d4f61d8b4b03aae2f391807c3bef811e84cadc2e867544313ead54b9dd685

SHA512
78c9cee11aeb12c2d683c4c517b57e729e57364777e9ce05d9d6f832e8793679562aa28afca84749f8c6d0ec8ebaff8ea3ce7dd2a7e24fe54ffe0e803157ce6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
667cbd290413cb7074e9b6328930cf06

SHA1
785fe5f8ebd21dd114edfc2fde1515fe17f943b8

SHA256
4d9c5b55ef8c3a72891266bf1d9e2b159c49bde21a7e3c06f49e8a79033f8790

SHA512
8f0e5fe0b31666dfcaccdcfd77769d0b13257cccdc9a4493b9978d82bae90358f579de2ec4904dea956f99d4b4c2cf8ed4b109b0306e487c9f2b1d0a09036751

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac453673c126edd239519356fd7b3724

SHA1
d5ac7659fa400a515a365e550580a6cb216e0d10

SHA256
41ffb4d7472a51c0d0b23f80b02ef979c5eff560eaefd14e4ca963145548dbd0

SHA512
ee7470cbcfa242d0310b9c2809c8a66242bd211ae911429a8e546812a97f94bbf14f1600d4fb4b417cd71dc50be03a573a60a8ee2f026f6cf936cd47c28afa3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cdef7479b401325e8253f8b8ad2bf7c

SHA1
2bab71b55c4f76cd10bf0a60d150333a904f1e60

SHA256
c6f6af313f2be9e8410f2a2242b6c6be8bc10cfb86603cc34abae332531d4e75

SHA512
cc7c77156897da2b35b24549eea2bdf359f11eb8d69c821a05c030a1cdc75a9eb1537f22cdcb662e33f106bdbf66c4623c6d048f2845c7e323b505a5e02f821c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e05826f02e234319edab3d0c3a75791c

SHA1
e56509262cb796a615429e7a42fdc4947a9bfea6

SHA256
6edd3c106fc6b77acbde206b8e293dadcdca9ee79129596d3fc6043b2de4d508

SHA512
0c81d556921053decd674e212aed805b9e3754e97e85a214dc3df8cfd255142905aa5a3d22ef34d9bea330788d026e11baaea35affce0426faeaac95bc8492b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
597817742967388b2f834e9fbd985c11

SHA1
47d0ee32908718c1824b6ac6940d4dbf12f307f8

SHA256
722650bf5f2ceb6eb3ec611ab118ac7656d4e5c704d544f1e79fa09810c85340

SHA512
ad8d813a79849b45339d47b8cd48ef7360976522d2c607c677d25f87923488b19951310d9e388ead2929ae74ee11277d4e88e903a85f0b8b9cde8d184cf7b6e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cacc36e95eeab777903149f65fb80af1

SHA1
2388362977d01e2e19247450ecf3b080d9b331cd

SHA256
4e7ef0430449247622f628c0a8b86b5849b3f460d33c62af85bc9b88bd27af53

SHA512
e8f9efaee64ba4b66b26de508257a3eea8c9d2dc0f06612bfec6f9282d09b4799e6013c5f50fb6ea42a7a76832e71d7d56d5d975598ebfaf23996fa3f8f8fead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b76779d4b8ffefb3207fb3cbc3311f1c

SHA1
4ae8e21e2d39a3d33a4d711d67da8591ceed9858

SHA256
0f9af07ef3e23fef4e5d8d2e8f15df1902fc0a9fe6f29338f02420fd52160a72

SHA512
f8312ac5874c5f30fcf918fe2ce290689727b67d085ae270e9b4dec6144b9e6313a8d824c91d7651be520c05a3ea79b2a056cbc68d456620a2bb8a29b8a6a278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5b4120a3bba7d1fb500ebb02436955c

SHA1
2da143d54aaeebf325cbb4a5b278fcc9b80c42fb

SHA256
6be6cbe4bdec91197de44c30575a94616384243e404b27a8c64314d0b342a7bc

SHA512
c6a98b66a596661272e08f5507e958a305d1e21051743a40f504c3980902862dccbbf5390a61dac748789d3ce67a8b5c8c8ed38588fd965e0756f90f63c5a2b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FIEDGG3E\cb=gapi[1].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\plusone[1].js

Filesize
56KB

MD5
1944af3661da46249991197817b6cd8b

SHA1
f952df40ec79fafc7c798f37aff92878977376ed

SHA256
63326a1c4e0eddd3501f0a064b06a2708eb0362f3ae934f53145978d3d0799b5

SHA512
0bef19b32be337cfba179ed9ce4533a207cfe645d2e5fe0da9fadc7b01c72704fc89749670d1ac48b8d494675bc62ac089fdc4d8495979226f10828225594376

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2454.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2467.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit