e1959783b96d35130464af1da50765bb0f2f76030c7086592542986ff2fcb65b

Analysis

max time kernel
165s
max time network
196s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fe17fc09566c08130e07c5ce9ce4d7ad.html
Size

77KB
MD5

fe17fc09566c08130e07c5ce9ce4d7ad
SHA1

f4324b5c89537fe0318925cc79b0ff06358d46cb
SHA256

e1959783b96d35130464af1da50765bb0f2f76030c7086592542986ff2fcb65b
SHA512

5b7aa71f82f776842546346aa2b037fcf4d4e02a5329a540be8f614dcebf6828e26116af3b4baa2b22910f3f147e09c136ea25f770f5bda524522adcb67de20d
SSDEEP

768:Zcd9QZBC7mOdMU7pC5I9nC4u2XdGc2y7Pd:gQZBCCOdX0IxCeyy7Pd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411000899"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3084b1b24a43da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BEC06DE0-AF3D-11EE-8CED-6A1079A24C90} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000085fb265a954675c72c07fdfb7c05254123ea4b102bff7ce2e57ce7d5ee5dbd42000000000e80000000020000200000006e972b19ba322dac444cdae56ede08a399d6a41641bf758eafde782ae099ef929000000087f37b1abb342768bf9492dd225186c6da93252184725af9106156083e81a389dc9da4b07b9f864b32b64781f8846ee754a8714466d7c4908f529ef77a72760754f65604bfa30cdb8eaf760faf15daa8ca8151904e6860dc7402c99a6752253414a290022e4696cba65e3a140fff565aa58ba06901ce1f689dcd10791557c385ecb4ebd55cb7394dd3ee043de71fc9fb4000000079fe2ecbaae035eb758180ef88eba8a98afa7b29177d9333b2f04f34a744b4ce296bf74bde318cd08ad90dbb99f4283d47e4dba2a023c7bb5c3232b8fdb20f7d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000000859cfaceadd1b3354767463a2c4823e9568ef224311466d3855fe5d3d03d52d000000000e8000000002000020000000a2a3fb3ec7ad8e3c9394cb73a63e61935b5c38573a7afa6043ba66e4099dc25120000000f16234728a00e9b874c8636ff8ccd255741a9617ab0355a39bca2a5340d0ba0f40000000c4d0e406a4ebcec450da4050b8138510680e17185834bb2fb884d608685c93f58ef0d5f0f24c8c64794d8059ef980863aeee52fb8c7a3ac91b40188ff0a68303	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2632	iexplore.exe
2632	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2124	2632	iexplore.exe	30
PID 2632 wrote to memory of 2124	2632	iexplore.exe	30
PID 2632 wrote to memory of 2124	2632	iexplore.exe	30
PID 2632 wrote to memory of 2124	2632	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe17fc09566c08130e07c5ce9ce4d7ad.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
443f74b9f3cd5d6c56a8bbcd436cf14e

SHA1
e6c494a1927505b2e0bef59399709762787692ce

SHA256
a70949658172d7755a022a761b4018f76b58d0d70ac2c7e6137f81a7e72c4037

SHA512
8ecd0a86bfd65f704d5b60ae99bd88ff99d14c233bff990b05747dc0fe5f63d9c6dd2e7810f323bb2c063eab6070f3037c9b5dec315727c1b17eec4df2f494fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcf14d6e6857e8fc9216f43f6fc8f7ea

SHA1
8171e42338c18a97772fb1b05f76d09ff7a3e8ba

SHA256
3e30f6eca62a9670d0dc368a905b3d2a2476eb9c886011ba74d66c8797af5578

SHA512
b96d697a7ffbdc0dc20cceaebfdaeec4eb79d07b8b655742893234606b2ba3f6a451ebff34952617519e4b5fc844cf272d2726e025ebffc5edc9f64e8d761590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce3405aa8f779cb608b1a0707e5a479a

SHA1
cbf9ceebcff90165c56d0532925e0864b372293b

SHA256
268fda48f75f760c876b32810fc349252136ed3ebc8526ed86b86423e3c31bd4

SHA512
bd5d5f28e32581d25b6a131d1413fafd46e3f576d5a19a6abf6cc23144c9101c405182b65bde87c42ec1dd75335c9de078f72a6a3de47b66abd8b2ecfabd05d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfdd32da4bcb14fbf6bac92fe611b4be

SHA1
b331cabb2a63750d14d4415a9c45eb7d12af5c7b

SHA256
739b697a99e795cce244c4469cca5c5df3b83b97670712af66a815c3cb43bb94

SHA512
2ce7b02d4a55f2cf945d036c751cf26dbc346a8d610c345481981243e9615827c2f082b301e0954aea671b0befa69d14cc019a908ea4960277428290c72367a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1aa01b15b3ffb5bbd01a4e304a6ffef

SHA1
8d42dd06783369eba62292854583608f7dc6c28c

SHA256
14924005713c44b48b87e248f4b7cb93dd4db631d70922b7b5f2686232e69cf4

SHA512
507055ca058e487065935242b13cac0f871564b4ed17a2bec123ebde22c5a7b3e63c15704c833de34df3b9100a4893adad18fefb7947a14b8cd05a38a391f651

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
525b0256d602fe8f7018f330afa6d0bb

SHA1
4fb7b360376d84103a09eee14078a55a27d85d11

SHA256
e2be7583b032a126cd76d4bb69791958640dd4d9ffcf55971519afdd5dbe23ff

SHA512
a38450b97881b330c3a9ae1c98ba2e320c19212e7cc919b86b318256aa6acd8c75b5eb5bc6b64fde6a6ebad17203e91dbbc9dec3bfd020adcc361de4a9628ba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3383aa5ff6b0b9fd68a3423604713500

SHA1
225eee3cf9ab2fe5392d7145c02dc20b7cc6fcba

SHA256
578259c1fb943ac85d2b733ade54be69cc9c4d6dc433007c73a54b8df61b00f6

SHA512
3d3372e6c852fe43eadad5c0cec3d7ba627c0c1ee485c610aff4f0cae18ed61acac104d7a014f3536f86d2650d2df6a713b28d3166b776dcb951cf54e8087233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2aa81078ffe2b2c1d61b3f734687ea3e

SHA1
6e9e8f5c81a24a5ad31fdba652e421292f6d1d1e

SHA256
4bb673f21e8bfc0c26f98657e567d7e0904ab9023de7616a765e860de68bd205

SHA512
ca07a22628c9870982e6687bd80f7b4a5cba7ae4390d991d1b85ceffee40a3a98e3cf8e1b775cee32f82c9ab46c08ba06aa566d0f6fb6018c25c518687cf4bf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7d024bf5f84917877d1e911ab4e2605

SHA1
ada05067a3eb26d4686ad66c99dc2877029cd2d8

SHA256
3fe11898916471330f0ca5f2a9fee5b1cde5e372d25adb37ff5ad22042d50373

SHA512
57f97a117915f20caea34ec8c86416b7257820c220d51e08e4ae3f9eaea7bd6de6003a2b7331517e0a5e195297c66080bbbc7790fc615095a40bfb0484f57174

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d59a6ab8c3ee613e76f0721828f7621a

SHA1
30c1c51521ecbcfaf4939fba4ac5039959272d03

SHA256
0c21b2ce3deeef90e11edb734c02cd0d7a3737ff666b5aadace6b76c75eb0adb

SHA512
f4614a674f6454275ef5509b08d8aa91c6894d6b1b495333f7e42ce63bd031a2b9e31dbb6555ef05e77a59a7d5ea8ebaef656cd3fcdc7bf5739dc25f8412a3e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4766c9513c5d93f89aa7c6ba35442d5a

SHA1
6e13aaaa69a11e5f232521ede636191afcd00df1

SHA256
cc8084cbb50a9a69408c9eb4fb19afbb1220620f4766d981d5d3fbbe2d30d529

SHA512
1d78b9545a4800a0b9eae05d1ab7485661cd5313b537325dd649ad215ed4205b1954d6a54079b01be97e85dafad27871b772bb740fd9b51cc018809a80546005

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6c85734c7270c32da2eaa6fd5023e08

SHA1
79de1dd253ebcdcdd607207b4c486d90ce37dce2

SHA256
2a00c419a10cef7598618e9e2369026acf18a396e860ace85add4d5a5b2a4f31

SHA512
a9a36d734cc708565fd46efce81bafa183a76aca56b70b3dc8d3ed0d59f7c9ce10511cc1e51faa5d832eee0e0ca983986e72a9aa8a6b2cace5e8e9209bfc201f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4080209538cffc9380b10a43ea172070

SHA1
cb26719ca10ffebe8ed67ac0c09a01815c5d17fb

SHA256
de93ce9c7f5eb6c7ab789149a35ee7b79862c05596d7c387ffb8a255361f5242

SHA512
89c4783d945ed68d57eacf220cfe60c216d3acc239c1012d539e4808947b324d8b0d756c8f67c1c5a7852ed183183a3f1a7675c68a9a3dc610af18afec23aef1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF5E5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar120.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit