c578bd38e24f96084b80ab802e48e7f6f51ae1a0ec0eccd46a1121ab37c46c98

Analysis

max time kernel
132s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 21:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fae119edaa5a16e68809057e9036c9cf.html
Size

79KB
MD5

fae119edaa5a16e68809057e9036c9cf
SHA1

32c2455344d14e4eb63403516e8be8f76617b47c
SHA256

c578bd38e24f96084b80ab802e48e7f6f51ae1a0ec0eccd46a1121ab37c46c98
SHA512

4aff03a4785b84991ab82e262d2cd487b41baceda31aa64aa8f22a647be3cace569bd86f8b6449363392eaccb6da7a264da620886b046ede6072196cbaa8a994
SSDEEP

768:aU4c6q4UJwe5owdnupKEPIbRBph/hOhjhr9LC:H4c6qzwe5owdnaaBQ9LC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EFD42021-AA42-11EE-B07A-464D43A133DD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000000c0533ec81e3cd3dd50274518380774c9fc26cbb209380268f1f9400eb815ffc000000000e8000000002000020000000406a914082650f78250f3744042c45ccc926fac6b26754ab9d859bbd9a90cc34900000008f75474bae5b064fa7e79db7039550f91a3aa7536974c796141f71b6baf4193c1539633666fff494812ee43cb3d41fdbb6226542900aa297dbe0b71c0667c98c94c48cf705594abe86c3e43c1bdc27cdb9daff826e23b2b307d36371be9836c74e199ee929cec51843a384d19321850a77862e36e475ed5e220b109beb9f0ac657b1dbbe6d131fd2697e9280fba7771740000000e8b4c2c7f6fa29c514e0ab3639b1780c1a1c0285181ef3a65853a583644602f8e13018e5e646e93cf0399794410b5368d57378e6fcaca9345365533ef174ea4a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410453377"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 105f48ca4f3eda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000777ccb010cb3a1a185b16e1a59bf467e8969ad85239d55958f43f23c9886a485000000000e8000000002000020000000fd25b075115ee5a0b767885f49d1c19bdbd17a42c1d823224efe803ec6a344b8200000004542f0926c153044ea122c174673429c92c50672da387e835d41c6a7132ba60940000000ed566cbf1e89ca6193395b9148e0d42500c21c58a34bd87413c6e342556c7a2f75289f981e547c0aff68025ed528dae41d609aca77d8eaef20eec487cb79266a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3020	iexplore.exe
3020	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 3068	3020	iexplore.exe	16
PID 3020 wrote to memory of 3068	3020	iexplore.exe	16
PID 3020 wrote to memory of 3068	3020	iexplore.exe	16
PID 3020 wrote to memory of 3068	3020	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fae119edaa5a16e68809057e9036c9cf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1f249116fbcadbb81b81369d303505e

SHA1
3bc787aedabd48a9562f80a422c63a8f9171cd6d

SHA256
5c9259f3b202c682a0aa6c414d158114eeab168cd72af869ec382e5caee3eef4

SHA512
61a058111ceac7995b713b20dcc252beb57733f45656538846d86c61b8a3ff3e28cf36256b8ee7294f5bd32617b46d5dc8f05bb70fd0c3e3423b52aac4c18f18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28b743e678531801e7d458417dc48869

SHA1
83a325c829eed2296aba4f8294627e37e6fd14a4

SHA256
ac0bf8154d0ddf93a9896de31a305ccd2f009b466e9aee6eea8bc2226a2d9019

SHA512
39adb415af148bd5e14263b2a561cafe3551f20a56215de1d1c09b6f6f18a3dbec2cfa7db69ee8d6f23587c20f0faa7b6d931df2e27cacc33ba6f30a29f5b2fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6bea1e71491f67b2c3878990c7cb889

SHA1
024f080f7bb171adfca38f1bacb32eff51c35fd8

SHA256
0830ff9ba4e85794fe5e58e537f38db612c71428bc7f660c8f6fc4b1cfba7b60

SHA512
ba288e70d7d8eee126e318be650141392e6c3c43bb7111981d4b82994803583adfc654edfc0e0f03d528c6ca3ee22e6c092ff502c77fa173b500e8f5485cbb55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33aa4260da86cad7a495eee35f00484a

SHA1
b264eed4f05671dfafa216ef02e3a0ec091c267e

SHA256
c9742844b782caaaf85af34b817610979865439429bc4d48959ae48f9768e06d

SHA512
7075a3dca40b116688795d4627320b582a73ab08fbe57898b0066a0349f009dd70f4fc960ab747cc695539e8a74e05c13e538ed33d339eb5cb25affb8747f7c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
968302b96be79a67621937731fc66c42

SHA1
2514fed8bbf674c349e42c6d15db870363a44279

SHA256
388c39a8429720754f94aef02482531833556a0d90ad887b826e51de516d1f10

SHA512
577c589e45b0a3d4784f1af22cdcda12ace7594e2556424ef43dce9b4a926f49c247ba6262a5a70c333ee2ccb148d4781d4d47f02c6b1e8cb9dad73aedd6b112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48e64cc4e266ee4cacd07a21fc7f1c4c

SHA1
0766934dc42fd8c3a91074118c6d299c29b6dbd4

SHA256
b153502f2b861ac69300d96b60fbc7e914625245b32a9c367e16459e9e031737

SHA512
2a468000240ea751ec25e5af30502b7c69167c280023fefdc4c7fdfa07935995703e4ce3d02a87b8b2bead50d78d09390b7bd619ffe2d031f4b18c32dba9a287

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44fcdba988700fe638ad6786236f293e

SHA1
d36833d16165079ecbddee58bd2bd227e3637f8a

SHA256
4373fbe0cf6e1e0d2b03f3f7670f37a952fe109654ca6c2e05cd4e049129578b

SHA512
b5132825313bbdd0fe2cbfbdf4b21cb7a237a3e9a48e9d94c34cbcab27e532d33a6f78fe45b1d179c5262f845f3a527a169241223bb5db42ff43b47a4d818f9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6754ab6e74d94b91e4bc316e1e9f4b2

SHA1
faa640f9ab96fbe3a0d3c05b38143a78fbad0213

SHA256
235b2fc7d7ef088d6919e5b82c539801628422bf658dcb75cc8c6322ed1e019d

SHA512
0db7cd72394699500443c0a253f68476e46379c0a288ce990a2ed77623a81f381b841f37fbf5a70172bcfab85e0e914364f6ac97e9707c54edccd6d0c0c63d30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8d7b3c0002271f195d93136204fb2cd

SHA1
e9252d002e47fc76f091bc949f290e71267568c2

SHA256
1f315e37db3cf251853bf7207e08e6d349b8e149a4702fc6b0f466813ca9c6bf

SHA512
e4b56952c527f604f35b6655cf8f2a4eced27f9b2a4ff393aa194b60ac0157db334b1d04682d815294d7a745e2abbdabfd90e90fe253dfb99bdb0b84077e66e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c50eaaeb9a1bf850c85ab2ed2a5307b4

SHA1
91d6eb8fc8a17fe9ce5f1dd4119d7a5c78dbfb36

SHA256
56868a897397c34ab56fd40627091a693cec1363987796e1b10251d2f4ebc733

SHA512
1e59987b08105604b32162e722c8397141fbe8c40939900dd8cf71dd63d609ed0e17e5da33f39ae5d0fe98866576a224298739bb7d9ac709b73015e3a8795614

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FIEDGG3E\rpc_shindig_random[1].js

Filesize
17KB

MD5
f019fdda31635d2a31b151ad8ad56c7a

SHA1
6adcbec55f66ffaef83d9a134423aa98eb2a2189

SHA256
c7fc0b1526533002c956ebf8e8c42c3ad3f96c41ace73fb4063cc89051944831

SHA512
fc278c12316e098976833882a38c788d812f9d36bd1b9b2b8c87dab4dc906af26a860df95436ea1b7d509236d44d0533d475a153437f8f5d42653fc28a77ad64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFLWQ602\cb=gapi[1].js

Filesize
64KB

MD5
ee01651d160cfc55249d6011a3c45916

SHA1
79d6121df6575974ad21dafce33ec98e3f2f0a7f

SHA256
639d75299973c7d3794eb7eb129e3b5a6139f9f521e1f14383abd0fd501219c9

SHA512
8a39dfc1ff2c58ac106225976aafdaf7befc0a28903a0c65e2c272e1967c3336af2b477ec12604400bb8e16aecee6567c9cb9d157e3d54649e28b9b2f920432f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\478691279-postmessagerelay[1].js

Filesize
12KB

MD5
92169c8a0fbf6e404267d0705cdbdf42

SHA1
a5cd88b74ca5ced239cdbfb458fe25540d671f46

SHA256
dba668b49a111527aac8f616b9053ea57c944e01a84ebdcd02a13da921223384

SHA512
8c5d35ea512fa7be367cd9a9ded2f23822dcce730e5502a355ed0d48949ef763eab13be0d50a66de6b0f8419d6a002c12c4ddbf20d97f5393ba922e48a4f02e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23D8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3133.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit