e6f53a0958a971a4886b9ba22b2ded71fa5207d39a6d16336ff57400517e92c1

Analysis

max time kernel
168s
max time network
166s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa8aa02e32fd49072cf97e5f4077ca3d.html
Size

6KB
MD5

fa8aa02e32fd49072cf97e5f4077ca3d
SHA1

28136fb38451a381df6e5940baa639b6cceaf155
SHA256

e6f53a0958a971a4886b9ba22b2ded71fa5207d39a6d16336ff57400517e92c1
SHA512

ec923d6c7c7dfadb5c49acb3fbf51adf4d721325b8309144e50de343b50d6e7e8cd8ae2263cf74c82949bfce32a7a889094adf7a70e77c0b57b0f3dc91b08225
SSDEEP

96:uzVs+ux7o6LLY1k9o84d12ef7CSTUkZcEZ7ru7f:csz7o6AYS/rb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2073e6ad4043da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D39A3E31-AF33-11EE-966D-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000bc98a69e23e170b0c24404124a1c01180f8c5bbc47d8f728016bdd9de74d375f000000000e8000000002000020000000c2f7c0ac26524fa16709e3c415bf02ca23ac2950e762ab93d797b0dfbb9e1c1520000000ffe4dca53f37a05a593405ef0d303a00f840e433b034291dbd292e59f46cff9f40000000e8e7bd2114a88b13dd9ce63330a2b9e1e16284ba5e5b3cf7bebae1697ed7534962e22f4d81e280c19f103e08885c07b45dd50018a259d0f35fa07ab179eac62a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410996635"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000020e4fd725a5d4190abd7b01a0dbc5122bb95132b1b8d456fd9829e7a39641f88000000000e8000000002000020000000e31aa6a976ac89173f3ca7f9544bdca2ee4cd66612caa004df0a8edeeaa701199000000097bf73f6ead28e442e45dd7895d000a4bc6052b153f33e4b4175d1240abdbdc8dbb2d9e0883dea61210614f56279188f70d64704a69e714ec8fbaf36f1a5ad3d357c61792b27c096a96e6e8a949e789673c33307df5e84e3ad3c195a57596d9199b77775f20b86eda74959505c58e86c290245785333d9b040d01cb9ba102107b116d6c78b794257b5dd689858ea6bad400000005272d6543d1b4ad0803a54c524ae472cc83a60082cb2e32f0825ce51f44d675a9f87fcf64fa39bc70a031929f86e68ab2962d9986de8f1b7869397c12d13d3c6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2280	iexplore.exe
2280	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2724	2280	iexplore.exe	28
PID 2280 wrote to memory of 2724	2280	iexplore.exe	28
PID 2280 wrote to memory of 2724	2280	iexplore.exe	28
PID 2280 wrote to memory of 2724	2280	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fa8aa02e32fd49072cf97e5f4077ca3d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a33d1f892ea247b5ef6280b27280a63d

SHA1
4098706b3072e67d28453c13607732c16601550a

SHA256
65c55a6d52c8c9ed30b433c43220d0d83e2361ce676bb5295d83b7866056af45

SHA512
9dd8e838308027db74f593f0330e9e61f729088d23268076d59043b0478235208b60f5d57af2df4f875169156d612c4aadde5edd8f01502d2d7503033d94082b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d954287eb77fcc364c399119e5353b1

SHA1
ecf28d3c458f3fcc92e7075655cace3176193d14

SHA256
5faeea4ec67963842ac35bd0cb7651398733fa7fea579185e3a0adf04b3c7c00

SHA512
f138291cd9a15eae58b4a4e3df690faabc940a5f19399e32230ff0ad2e569f92ce090f40cdbc976f41749126cc86bc31fda99e7c7bb407be45443435a6c333a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c66cb8c70e6bf7178c3da25104e6f134

SHA1
a7218d3573d5ea179a8f1bfde316308ed1a3a7f5

SHA256
daf0f5c805e23c8053b3bb180cfbfcd86ba75f514a802d64cdf02fa8987a44aa

SHA512
d1fed08ef4c2a624cba0c1bb02043830e2bf2cfe3929dd26064dd4431819825219a1e1a3d32d6f8f6d891662460595bdd8e601c5885eacfd9623732503079f4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7c568d8ce46ef71e6b9021d5734ffe4

SHA1
1398e09f8e9e10b762a9e99d4aa264948623a22a

SHA256
ffabc86bb5100c435cdb7e5c1fb5b2e15d1893d228fb104630e4e0925337bc0f

SHA512
a69673f579cc6c84006bf245ec9e405e594b3fec720b5e60a6d5facd29dd7c8c46d53e020fc609864e41dd1b6db9742e6c26cb105629302f330d71e9768b835f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9d3b403e8f17b94557bbc36b758a38f

SHA1
53512072c6675a78b670c08fb9beb6cff63e6e80

SHA256
782ba9a374e2552f2942b9536a70af96225d802f56f2f236875342c4eda5b62c

SHA512
c8855c643c02675bee7762fcc797b6d9f1e87cfc719d95ed29d8637b2a5492593f36ca217ab83b717766d68695dbcdd38958924e2dc6f805860353625a5a2817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f20c7f8c3f2cb8b2d735a45141d73fa1

SHA1
ac2605c319b3889fc9432689d539d7081499945a

SHA256
21f6c6f498c29a1004fb6cb1c816f5b0cd285e0ab570a73451bda6f40882e7f1

SHA512
8932f688142bacaf84200500c5aa101524fc02c6a40c2f9eecb21eaf53d8e91f1e30360fb757efa9c4af273f1e438098699f6dc93f6055ce9d9039ef1b4bde62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
555fbd74d3112196fd4124a3b017a646

SHA1
ac9c264236ef986f831c05bc4c5659600c2bacc4

SHA256
de298e792685874102a2a92d4ddd4a87d60a3233ad359c1c19ab0056c4691e2f

SHA512
5346b4063936ee842bfa636bcbb70ff08b6f69e46a2021fd94fb5d914c7291c52b92b53660e387da4f2969f65f7db0cf2a49e4cd140a0a82601334b10dc706c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5dbf8773b27407ea5acf49cb67a1a17

SHA1
c929908b4d9d6d7594594be307f471e6efe396a8

SHA256
1d4e2cd8a9f0b9c99197593890de930ddb6560ccaeb865ee7edcdb7c1b6f4b50

SHA512
f9a09faee6b220c27f7d8e8ba9ff349f8aa1cee9caea06952a5a691ae190d2bdb206f927714343cd2a64cbf53d5e2cae5ae99502bbd0dde5a6efe7fc7bfc313e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49285ea3342788d5a344169b15ef4fd8

SHA1
e2e4cfef21c3a1d1055578275f853f73b2d72616

SHA256
a62df3595ea8854debbb7e8fd4824e8dccde1d64160eb9ae55d0d91f212e60ed

SHA512
74e6abfe1111936793c7956eff1bdf36b7b99b78fd2d2f265960e63bd11df43e483a14cf972fcc724dce18df75592ae0561e7b25732e685ed619a28f497c41e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55acbb3f33487b2faa0a6a4e3b286be7

SHA1
3e4dbbbe8bf2dfea87d0b30b1644d5b0a6b3fd01

SHA256
f1c454db0457cf5afb2424386906512321badf553789f98a0b629bf46d7255a6

SHA512
8d24e3173f1012b0cdd89524b8d968c91068df8dac392b4054004b5c66deb1c7fc3d3cd2a6608983d9a3c285d3bcb8f03b2c9673b70c1b5480799d1ca320b00e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4b0f4b9c8d07905de1d590ae090eb2b

SHA1
a102c9299ced356dcc1077b2db2dd36756f906c5

SHA256
5f78c615ea80121a9b0f74403f7fcade22ebe56ebff7c3fceb24858aecc76213

SHA512
e8ada2376d429762b4b7df7a067c9e520857ea821f63bb22381656340053e3f1fc5fe65876b5ede485107cb45e287241d325b7eca9f936d4108984e6d1685b47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6d1e0e6043a408b21d8c1ab6f354e19

SHA1
b7463ec54f1a1fb770de5f7ce46eb264b3d54ce9

SHA256
602c649d9bd15a7edc969eb73e26b40d62ef6146720c91d288e9473c6c6a9fe5

SHA512
603d3722b7a70ad397b53e02dcb97e6d101db491e43c45bbef522aab768c3e618ea05603da98cda8b74f3b34d66aee99c372fe912df56a46f4c8601cce0842d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
136cba4e968c2648abd6437a46290b6b

SHA1
3f402e401a089332a55ddf56e9ec83eb3705109d

SHA256
ebdd3fc198c24b7634ef39e92072c23b38ab4bd55f23a9264779cfd3512ff1c3

SHA512
fe60723479b20a1006b774ecd87d5f0ff249f39021bd375bc3154db827e09eed6d787be6ecf54c5aaa61d161799b20a6c9b5e2fc96825e5b9a01184d61b98fc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE8BB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1119.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit