e8276b46ffd516bfe0e23c38c5a3b1374cacf72c0b44f10d699568474b287d34

Analysis

max time kernel
175s
max time network
206s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77d3f34e31f2eea53bf7ca98a7c64ed4.html
Size

18KB
MD5

77d3f34e31f2eea53bf7ca98a7c64ed4
SHA1

9c0a2d9ecd62fe0278a8bb69b19bfc532fb84b33
SHA256

e8276b46ffd516bfe0e23c38c5a3b1374cacf72c0b44f10d699568474b287d34
SHA512

ac6712ec528e64f2f195f5bd7f6bda1ea112cdff4f4ff682efb6ae50e7082ad20b196bfe10d6aa03257da9a90b424b17395dd9d72889883233d29d9d4530b48d
SSDEEP

384:fuzcEZUL820utnQ5P8p1r3B7Iw/9MWZc2J92V:4cESYdN5Pc7Iw/W

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A86C0121-A52A-11EE-B160-56B3956C75C7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000021e3135d91a35d5c596c5a74336124517a2a301a53017b4c24361cafc1676aa000000000e8000000002000020000000a3fc6e7d88de01ca0bff1f54ef031085abaf9288d5facc27c5b2efe439276e3b2000000023296db69542cd7fd2f84a02a2a9f7b8b900b5299700a713337ab1b35885e6a84000000069784c83149afaf4f7d5a0a684dbe37482b8485b4eeac18b702e7e452be26e5839d6829d9024c106cbaab9586cb67ddc622943eed8420188c09f58352d3f4fa1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904ff5a63739da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000e282060fbb511a3a508cb55cf59f6e91ebf10e8b6b3fa87f635158227939a178000000000e800000000200002000000032a0fdf876227deca75c57fa1141dc7773bb7580c2b5b17e822bfd8a7ad770c990000000ddc381092875b2e7668f979578d545311531a06862c0a870cbbc7a1307eaba44c4f21c23956ad0df84f9d0ac47a1418828a810e1d6c5998c68dd32f2b9675f16b3d3374ddc09911a8e0fe8e38e5fa7b6601a9e621a903cdaf3abe7ec4524834424c0a89ea3d37b7cce98b3d24f77af021f327f66dc1ac8c7f95c7cfcd44cbaa25469b76d89322d8e58e1363f20bb6b1f400000001ab5aad54940720ede5b2f89a811d3f189c5c040f256a979a5f1c991bca62b6926cfe83c39635351d6bf986c2b40fd26fa52b0586a60417d4084ec892df3e8aa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409893186"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2516	iexplore.exe
2516	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2716	2516	iexplore.exe	30
PID 2516 wrote to memory of 2716	2516	iexplore.exe	30
PID 2516 wrote to memory of 2716	2516	iexplore.exe	30
PID 2516 wrote to memory of 2716	2516	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\77d3f34e31f2eea53bf7ca98a7c64ed4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed8747ce52459b1a1105a84cd87e35b1

SHA1
d734224f896629d58a7359630c536b965f5f64c3

SHA256
f99015cd2f2308f61dec614a3b82c2c470bea62407db20ecac9dffc7948386c9

SHA512
2a12a738657e90b3a0e331a1a84bee13b79fc320cd15ccd67cce4d743ebff15dba8cdd5215b2d88b993aad77de12d99bbebad18ac6908da90e1693b429e1ece1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c69e2b43c342db378a079ec34e4a07b

SHA1
a17904085c970897668c0a8ac98d37a572e7f00a

SHA256
fe9e91d97e32e008ba04cfbab29cad5d025bc3759b60835f8d275fb4470bde67

SHA512
621c0ad01b89807cfe310d06b70970e50a757c53ea4a410690f9d7a655305744ba5e526149487dc38286d12614a2420eea6ff06f982ddcba14da449d0c7a2a3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eec3939d3b3785a892765240e512f7fc

SHA1
f27e0b43769887237e1c8e3812fad17c0f9923cf

SHA256
4bf56ff14d693ce1b1a8e690b7d412dfd7d03bae86ee09bd0b87114f1756af1c

SHA512
c71736781e35a36f579100258e96e84beb55cb8667e55887b4517a5d3fb929b085df724398c53c005c19ab3209848a0f98ee1d30c398c2fb440ecbdcf350f644

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82959c252d8cedf3fe63d5113f846a55

SHA1
c8c045509409eee02c8f8d08bc50de1786a66174

SHA256
0e5be752b45485ca08379cafdbef29da0eff8d54830df2d3a95ef1bde0bd2be7

SHA512
d824c721ddfb3dc36fe744a4b560aa3f84dd1d1fba251fc853d07bbe2eed65851cd4be8e6f5de9634f24eb069f58bee63db3352503ed04de4463d169eff5db23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67b00b7f402839faf5c176efc335d34c

SHA1
dd167d5b5daee7e12a22b2f996caa1721da83973

SHA256
89fe3af70ce616924ebaeab267c5c10e003e5d5923ae97fb3adcd3caeb00a7ef

SHA512
69f0b48e7f927aa4bdf59a8ec688419d1ac6e7361db9baad71aa2d9d5f76600b2387c2837d6d518bf81257bc1bc8f7335209516654b2115609de9c0b428bb5e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f37c2f6f282a05978c64d7648761a80e

SHA1
2cb701ed2a67704f246dd0836900b31fb61145e3

SHA256
909fad7908979f50e9815e9fe5654128aec8b53ef288c6e7ba396a2dc89ad7a3

SHA512
f281321f2b431c5188b4f5465961d29813bb5143ad898da742d2a63cdd0a2a7bfbac74731a444283df71e6c79cf53b1765e5821390d905642666dc153ace540a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d145bcd6847d35b776b52fa5df452b0

SHA1
41c402eed30a82ae2a25eab526b14e361c44739f

SHA256
2e139c2f6421b05d7d62d67c7a8b938fd775530d7b9ba641271c24c7213ec2fa

SHA512
22a892b277447dd4b81933b42f659e8a0b6b07bf31f9a5b285b230013727f83354d84fa5972732cd37f2f6fa0c1ae557d6661e2f9c2f7d39e8f8927b348d7af4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50f008bca3b8b933cdd324606dd48755

SHA1
6040375ea69982718488087dd519fd572926689a

SHA256
920f0cf907cd1a6f5783aed7bb24e06c7654329d9ca5ab38578efc1bbac930dd

SHA512
0b50b0e7cf92daa34a814b4853d1eb3eba6bc3a7b48a355d8f2d6fc0f91702581a90b721d82d35f4fb22a7dd4f2f44363731e7e18c6157996dc1e3e4fa5affc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf9706e3d3d34d1cf195584b0e22d6a9

SHA1
cf4b2f0a3681a9f3030f1c94aa4392d6dfa40256

SHA256
4e6410d0d065fbd48215574edc99b5d4c4b4e819e5ad588378d2bfc602090e19

SHA512
6f11e097922d804ccb191db06c5087314e510a93360954013c290601c09c217ca84f1b2f96c3e426a6910d8eba36a6dc4ebe6fa9908615a63955ae3a40cf1691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d36e8949cfaebaf4649b30c9e96beaf

SHA1
1b4b975701bb622981f733485441d43565e6e99a

SHA256
45518ac5a43b1a8f862aaf80f06a6f810a537f1ecee01d69c1d6513a3c078e7e

SHA512
b0e4508b5ba9c4e76cfbef60e7b07d34b408565142fbcd16165665f57a5d38e13f2a79b8890690b2cf0e5cb8266e8e577d3721cddf5f905267fe816b7f59b050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
072eee14a2ba9f828475eaa00e4ac5ee

SHA1
0c0291bb6043e60516b8e6fd5d3d476f5c0a97ee

SHA256
4236ff015ba02e3fed7e2d1611a1bd8bbaf0728b76ddb1e61009f6059ec06d66

SHA512
040ab87f5671a457d1984599a854d5102c7a8723648672e308e6e5680fd4102c044e0adfca7036f5936ff39f0bab650b55184f34cf39e0b1b176a4873e842fad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a08b5fb22ed6cc295dc437f8830026d1

SHA1
619a9f31d164cb9dde0b25870a748f51edb3c326

SHA256
4703a9e09ad8f2d04f605283524e8545bc65876faf6f90e467711b17c8a71e20

SHA512
65cf344bf1ee16f1e0e7797368c659f25fa37dfd5e2fef65ae94b613f58a913a6c6878ae3c746bc5fac28339a222ba3262a82d1cf4c14082a2b2b1db8e30721f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2DE5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2EA4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit