e8b4e53480c7ddfa28b7192f1b50bfd4ab54d45122ecd099f7a670ae4ba7b651

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

773d9474d3776cc2cc95f8fbb9dc8c77.html
Size

53KB
MD5

773d9474d3776cc2cc95f8fbb9dc8c77
SHA1

fc0c6711c50d8eb998e97f817785367418a969e7
SHA256

e8b4e53480c7ddfa28b7192f1b50bfd4ab54d45122ecd099f7a670ae4ba7b651
SHA512

b2c2b0d1e14aae4d998c4e59d8a8cfe40efc337edea3aba448fa73c46d02b892305d2d6c812093d75aa41863f9b3946976827f9dad288c1bac4dfdd5de36a57e
SSDEEP

1536:CkgUiIakTqGivi+PyUerunlYB63Nj+q5VyvR0w2AzTICbbOoq/t9M/dNwIUEDmDc:CkgUiIakTqGivi+PyUerunlYB63Nj+qC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D96CC21-ACBB-11EE-868E-CA8D9A91D956} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000e1bbf254ee20114e9c7e9efbadef8a34574fd442cafa8cef98c1aa5b0f22560d000000000e8000000002000020000000202172b411f7c0827f4d0bbd60caab861aded84c54e3a2f517ccf94d484e960a90000000d96ae4a63428abc7d4bc0282ddcb30975f64897b31ff18c0b1cf11950eb80d5196b306ae71aaf5db55689c02b3ca93aac95ca0beff4236ae9a17322a38f578f88991257e79adb52ee0a7da844a7791fda5e74f67ba6db5b022069400aa1c0abd352b6b6ab76b2cc40514a3d1a8db04ede87c725bf96275b09ec8a628f1043e47fbc6b08377dfe9bcbc1d83f1a18136574000000056d778a58fb7a4f5d81f5dc91d1fd3f099d5fe74e8e67f31cd3815e4d46d1acf8334c8a648bb65165972b1c0fa913483073d6525ea4966f2809a88d9e8c9a086	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e5107cc840da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000a44343018d8cb45a2eec6c0a195108cbaad864e4fdd25c5ef804d760547981dc000000000e80000000020000200000008da9c7592ea29f90dda50d64acd53687c14c2f8a67c71548fc76c39ec91b1893200000008944fac6606234e8d2049eb9ce268fbe703a1759aabc69610fbb0e9b2f8b183e40000000ecb1ccc06227316eb155be4935302256648f574a6693082f9f5eecc117e6dd5a1e2a75592085a3feef8ceae510d806ac1f52cb4e83d4869ce46c72746dc6367b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410725084"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2520	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2520	iexplore.exe
2520	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2776	2520	iexplore.exe	28
PID 2520 wrote to memory of 2776	2520	iexplore.exe	28
PID 2520 wrote to memory of 2776	2520	iexplore.exe	28
PID 2520 wrote to memory of 2776	2520	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\773d9474d3776cc2cc95f8fbb9dc8c77.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2520 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f81c9347c65225b36d35bbb98aee056

SHA1
a2289e61847a824456a7732e3495a3b3ecff8304

SHA256
2232fc1626a02bb0364be516e2c0d084e971cd091e549962a79ace7a88e4a55f

SHA512
97b02a8e9b75e7616c47f3d2ea424ef47634da0ce4c3f31a9a72eee326d02a5b4a7da7b3a455baa5d144b5fee4bae2ade622691e406bc4a5d35e11328da59ad1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
767af310f780d3731abea6dd282fe3b6

SHA1
b238927e8261e1ab107ea994cc9fa97d95fbcdb6

SHA256
366c8efcded040c1fc5326a34a5b3086230f9491cfc3293eb348d0b8b170292c

SHA512
822c8c4cff0406e70efe714418fda9070a4d6b940e76ce823cafc3a5220328c52891fe7a5921f62ff1af8e3b546865a27e815c23bcc6633c703620c7a6ad6637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12f150e955b9c0cf96c0a8ba1966fc7d

SHA1
b1d0213d09766d128f36a84fa3b38c4bba675050

SHA256
daa22991c2e4669131e904fea8b74a72acb22a3fc7cbbadebcc3fa8628532686

SHA512
625c5f8546220ccb408fda80ace3eac7c3f1ee3d903a55696cb2b251d27d6735e11b2dc967e17a1909a7e58ccd4925d08139cbf6ea12b65130dcf48c950be03b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6e13d1787153b5462d602c36d0abcc5

SHA1
d3e1e21b914470df695fd38290756c0db4be2916

SHA256
e2da5a17da1ac9cd54b0f3b6dba0870ee68ba91348e4869f81d80f725cd9938f

SHA512
d763e93d2976ea84b3e8e1e76273ff3a9bf52d9e39271d3dc8f9820128ba3d87252439101e695646ef89dbc7612734a72885d5f195dfdfd5f432979eca2df761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87f9ee8b26ad6effe5b33a9c1df05d66

SHA1
96da9c9613ed0658f774fb7fcd754f5d9b1f9bbc

SHA256
97a629d65a33c388b6d9717e9b6a4c37c96bcfe1795451c1c8fd402ec0899fd7

SHA512
a2baca8ef6b07e45a6f788b59eaaa40ff5142bff9167d0e25778702faf33714c68cde15afdd05733f641175561f1f40f8902bb4667e59cc241a190870ceed301

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
420ad4e11854a1ca31365ec7c6244ff9

SHA1
fff141b3f0ba5a4655acdc3ce38566e47e8a8a5d

SHA256
5804b1445391e943e9d90d6315f312308d83e3e300f43b24432432f7b0433f08

SHA512
818f12c41a1c5e0f1accc2d87e086f743708220dd85da9004700b0039328d866a0cfea542901a5e5a342ff2e4f52c3af8f36c91d3d3dc084457546f876f5ada0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0f31bd737174f5e1eefc24ad36c1633

SHA1
4d7f95289538cba6ba38b4229b2914fea47ca790

SHA256
1c2c20a822717b8b5f0fc27867bc3acb85ed0fc43edf4e359fe7132d35107f14

SHA512
c85f643711d6a7c111f449a20346b860471fc80260f978f8d15738255c2a5c0037d6da5c9ff436c1a42578d81b1fe8cc0c3a5795c318304b996dd5c316ba2100

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7dc1dea3ea827cccbf5bcee48db7453

SHA1
dbba318a3562a30756f470176c6441484eb354c2

SHA256
de82f48b5a903d95d48748738fd558a8ba858cd47197c7be11e77cf22178e18f

SHA512
496bea8a502288af04b36714b64b00647d6fbed054299d42b0be41fff11aecd5cd63b70b04af6a1e5cbb6be8625c3e4cc497419adad7acaa93d44b492ff75b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
640342bbe8066c49410e8c27076e3b90

SHA1
5eb393e22153814c421aa111c23df10d1d9bcb56

SHA256
ec75265b4dac0e08220b8c471bd2f1962932e343af77add998589df173cc897d

SHA512
c77bdb875950540ca5f724f3de765981d1834a96131cf937881790dd10fbc7c09b4bb98fdee99f1ddc7f9acc8395e04ed43ad355762aa5138135ee7cdfb4c4cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ca2ef1459b5ec87f61fa7ed82486620

SHA1
acc962e454916806c429f496e150ef3d2826d332

SHA256
293392a350c17a6b9adfb418b4e722c33c7b70320b4db601065c42a2b5f110cd

SHA512
aeac020f9039a8e02826fe496af6b3ef5c909e71e8d780c0b043a60ee8133b66ee0b108202b6f2dbd49861a8b5fa3c5b3509d90c10133f98ff606e4ecc1067c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc3354ee88886f3b34882aa3f64107e6

SHA1
7b0146f67f3e698b009ae1894bc934796c3d80fa

SHA256
0d1ac18206b0fff5cecdeef40f16714de4e45cf195409bfaf178b36631ba1433

SHA512
4a67ddfb261e8479d1cf25c3156772a707cb53df5285d1df399deb2b4fb25ee998ce803f6cca7fc0aa9a5828eceb2ffa061f1c6c7846fd6f94453558e51a1ffb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19f1cfa0530fc71793f566188e82a3ee

SHA1
93adfc557a1f45ce6ab1210069a79d155f3608c4

SHA256
b01a73c7d175bb33e91ea5ee5c68552de9a2bad6f8e2781db74c8019dd7cbbfc

SHA512
dfa29cb9f1c449d5f728423b50a49d4c72f529f64a3015041d1b094cf2db98908672711d7ad8e6ec245da611efbcff99bfe076b6713447468503220c3cf5c14c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6d100c6c2fe792e1a113b037bef8422

SHA1
eba774b10bdadc882f8a5643e84dd62bb713d8ee

SHA256
ee7ce44cf3bc4fb7c4c2f7081a1d77601f4b0f8e46a12f46bd24bac66713d5ec

SHA512
52bf63762a078f19ea0541dd3ca2f41d542462aaed0670b65246c52f159c637316e8885ba3e15b72cd8bcf58cf9ce66d1e095459387b1edf539272f5b7179460

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4082dfd22e46b3e5ab56069e7b5273d

SHA1
b752a3aee19d486451d253666809695694a6d0d1

SHA256
7f9a154c60e7a3864157e41bb247c8dafd07adf84aabf7037946c390f6551d2d

SHA512
9ba1508d79069f7e12a02bed3032ce92fa8168a675dd905580bf1600c3b7745b9373aabe92377c2d4f71e7f072a1d086de9b854e136f5407c09e851974f74021

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4ae3ba865034d8a26124ce4cac49258

SHA1
91d71310784ba1d60aa4c1ceaa07a43cf520a928

SHA256
d25ac5b591d65ec1d8d7b378c96dc484b942bd3421799c52e5fde3a6127c2a2c

SHA512
b04e0660dce9ead5e9d9eeacb5dae4d8befcfa2048e385e5b3bf0c74e4508f91d4ec67408ad127f1e590544296683eb2c828059346438bca5f20653d67ca0762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab514C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar58C1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit