78db566e441fd18ccf4fe7fdc3793a316728c5f08a74ded372805dd80eed94fa

Analysis

max time kernel
145s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

759a45deba5452b7a62e4ec8b461e2e1.html
Size

248KB
MD5

759a45deba5452b7a62e4ec8b461e2e1
SHA1

9a35ccba994078ad1f56fbc206bf273fd6762e00
SHA256

78db566e441fd18ccf4fe7fdc3793a316728c5f08a74ded372805dd80eed94fa
SHA512

eb78cad0d664ba32c981657d289541a344234f85dc2b2c3d9de808d59e6cedb8e0201fb4c878f040d1aa8f301467c1b25771ce65d102406844e2c887751bb887
SSDEEP

6144:Gq5NB22WnGlQqnZbAxVrlrQuyT5nZLrlKg3Ybyu/vROvhPZHNsY:pNB22WnGlQqnZbAxVrlrQuyT5nZLrlKU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000003a29142e44e02c2efc26aa5ef34eccba07fec47602e5f29fba01c115fdd3a505000000000e80000000020000200000005808229782b872a9898be0bda251362f1d1a98dab72817e268b092ce27c841619000000047d044cab5e6166ab9079076c995131542fc1fbf0854dd1ecfd870d3f2c4efce9375dd39a160b78a99945cf4d907a808a42ec9a243f0a89e7b4c5f623534e2a03bc4962b6869404a0a093c8a740bb328a1009471efde5a241b3fbb63476b39d580e0fcd9016ff27269f3d44dd97996292960f1c408c58604b9aca9ab9e47cc578921b1ef4d8591ddcb2e5d8fc658fd2c40000000b3e32dc089a225ee1c1c51e60692654a87506b28dac4146f1ebdfe20f28445f364d9ea5fdfeed5c862ff8287b80771e78f1a91a9862384844a8d02430aa42198	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0544da92d39da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB30BCB1-A520-11EE-9AF4-C2500A176F17} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000353dfd9d349c3e0fee98dde8d1d4ee405fd8373f0466d6eaabb05ca96df227aa000000000e8000000002000020000000c94709a92a0bf9d73c9e66963d2de4223140af47ee7c53bc374d068d83c0d3b8200000000e4a83c022c4e594535eb17a3752c7c9bab050bd03342db5133e135a2124e293400000000d6796f3ca27fadfb970064e95cea65de4894297ec507269e294653be5cd3763366602b64a09aa83a1ecce35ae3599240cb244181e5dc4a82dd69f58dd4ad268	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409888925"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
688	iexplore.exe
688	iexplore.exe
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 2424	688	iexplore.exe	28
PID 688 wrote to memory of 2424	688	iexplore.exe	28
PID 688 wrote to memory of 2424	688	iexplore.exe	28
PID 688 wrote to memory of 2424	688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\759a45deba5452b7a62e4ec8b461e2e1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80b1b8ff2f5b5f943e4c25a9a7f01069

SHA1
20a255503587d50603bc0f70649bef70745e344a

SHA256
cf5b4b1c9c4c2348125701fbed0ae18aedbd1e2cb03e4e4d5158bc85bcceb2ae

SHA512
650d923f5af399e4c219fbb6ce0ed56bf03afa4e7a68c6f07cfe133fea5456df698c45c0aab51492201455d99e28a3f9734f37c6f5136c1fda7aea53a938fa70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
704c5de078184f13d48c1f3063f523fb

SHA1
99d00ee62fdcfa857121c5027b0c6ba1a2dd4faf

SHA256
f31c560441c464a0d6378b2485fa392606fbe79b117678eff0631c78e1fa58f3

SHA512
e84c91cf7ccce9a86e6257b9a9cf283bd6843178bfe026612ff465dcdd383c30d0ce84e004d4828766403c2dc7e9fc5381c6f719296b189ebaa935614508ee50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
694c6059af097028cd4942575c3441e2

SHA1
10d6f3456b1155fc738bdc5e075743dcb2d8dbbb

SHA256
2697e396917470c7bc94d41fd8628d8504a636a65a7ae57178663f899fccc0bc

SHA512
08bc7d828336c02e2139117de9aade45857c9f609458b4028e4b74732a5978f95fea46c58f5524af14dcb832cf9dd4cad87641ff66907e6a28fa3dc388a58fab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f495cc571d23550efbf9c82fbbabb7ec

SHA1
8210bf373d9ead9f6be8ce6accc50946bbca8287

SHA256
60c95418c419a4b452122d6d5f17edd6f121fe01a6bb5d4dc2e3d6aa9b237223

SHA512
eb4bc47d9e6ac57aebb5e5a2a51e38b8209c68e0e94018d4b3deab6a2e692672f1f9741b0dbffbc2f1b7de812487c446fb6d5bff0a4bc9739a1ca8ce4118c8f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1fcf18c49d6c7a785edbc7c98e9ae6c

SHA1
9d0d4f35acc12e8925daccb8851c31a4139e4d5e

SHA256
f0c9c0f6447a9bd0033eb9a3637b12b0ddf75a9f7c8df7bd56821fc37beb45c9

SHA512
1ebf712695c09f1a6247e46ef1b6906a695e0defe31dc32051e4b53c4b33b3dec26b34f502b872e2b02e8306bb6378f64a9a27555c2806fb012262d805098710

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa7b3b395d7ba8902c7b03f85ce8f0dd

SHA1
5091343f23087b8628a071c278b8866cc4d5abc6

SHA256
56546ead7930ec6f3a92020b2c3f0e0961130b7e41fee8a2586e6ceb9343110a

SHA512
349c517bf2a030f5c22b754374455f424cda891214ff42647ad8821e87dee7d77174afe2af557857982d372bbfcf35f98aecfa34f0926530970dacc49a24d964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e3dd2670481f410ade78690c91daae0

SHA1
61957ace301fde413289e0c869fef732ffac9934

SHA256
9eaea3ca2663710a4897d116adc893292244aa8a9561ad0a2dfbbf449346ec79

SHA512
75b88415b05fb00350aa38803f413f7529434c13cf559858c53a2b620ee04d259a772053b2e66e1c7e513ece842157f49be3a7f4c858064079091cdee1d0d7ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcbf43eccaa9dc0241eb2578d40a25b7

SHA1
b2cbb4353ff55a18178b9f3816b52b53c9b5b190

SHA256
4d02b77a50eb3514f4febf595c9ceb8ecce13adf783b5579ee47d621f697acd7

SHA512
34f1f8c68fc19feeca66ab61576a3c7b6efef55c82ef65efa4db83140d2af518bb347c8c57d77d8e4e538c7e9edbc9a08728715c872c38fab986c34b73669e17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc1d89b015a16c2acacc758d04d34467

SHA1
e66a8ac07f47a3fc8919e520cdff7df2c3b77b02

SHA256
556574f7293d4d7778fc32ca71680a598a4912938812b8d8c5393bb3506351f6

SHA512
41e0947c28e9283c14c67436a6bbe3d90e795b7ff1c8e1bd847e07986108a3cfb057f99669001ef09905ba94d797868c25162dd8fbeff4da7cd6bc14f4c37d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2e302c691fb50804d0591050a67f76c

SHA1
d4b00d8b893fb55c73ce8215db46163b61424541

SHA256
0d0581c06c63aae6294d2ab60501715fd19525258be447bf67e57b8b2df3c3b0

SHA512
59c1d5491f39c9aca45d8bea8be8302619d1a1d104d427ce12daf99953fda02edea8d283cbe510cdc0dd18039e52cada2bed1e85928c6ba794947f05b6ffe69f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7128ccee372c7e4198a4b4251d37a09

SHA1
926463876fced6f66efb4d58a1828655a88fd4d5

SHA256
1a6007188a2fd1a3c3418eda602833ace597b48f5fcb8b6060a83b003470ca0f

SHA512
39f90fedc1ea83639d083a7de433eea5da1851b10d64854c67f3e9d5b632e77166714bbdeaf5bf852c16d936aacd8aad69175f43edcbbb139e1bee50b39e11ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\f[1].txt

Filesize
34KB

MD5
94baeae5a431d3f4b6a82c4a91f59511

SHA1
42afc199c30c4adf7d69bb10cc1b7674102cad6e

SHA256
df5d165b5af8ba63c3b606253a8c73dbdc132bc66153c867b4acbe47efa55f0b

SHA512
866c5064e7a88ff99696a64ef6cb3a770db74ae99d773754613422f6fc4d850eb32945d57aabcd0cbdbb9bec74ab2627a7d7a0cd14bd465086db0083756f0017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\SV8M2I0Z.htm

Filesize
104KB

MD5
104be976bbd7a0cd8f23739be7bd591f

SHA1
023a6f3988bc70aca38a8d055204d81a16bf96a9

SHA256
b43d988f3be5c08a4816ffad10a0a37c08131013fbce15fbd54d22f9af177c58

SHA512
9f88f34f5d57ab9a5294b0f2a1fe4edc7c65f7b0acf19f7781bb12a6ebe893624c112664f397f6716173aaa31f9165e4b06dbd4fd91bd770b2145ebc399ae4c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC33F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC43E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit