f48f8041ce0728030687471759e24cdf0d4256c1d3188e2afeabef7cf54b9ffa

Analysis

max time kernel
123s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

052a7702efb565458d01160702a44ac7.html
Size

48KB
MD5

052a7702efb565458d01160702a44ac7
SHA1

23bbb2b11bf7cda72c6f92074ee195a6aa755e0d
SHA256

f48f8041ce0728030687471759e24cdf0d4256c1d3188e2afeabef7cf54b9ffa
SHA512

cca29c8837b813be7a66c5d9408784e6ec4619d4198fc237ac42a806a09eb3c19e1dc35408a0078292bd56a0b49cd596bf38fed33a412f00f20d91bfb6de5690
SSDEEP

1536:88hBEIIVJjKHQGYIY+GQ4F2KTYay73w68nPP9XH1r+ideFWAs:tBEIIP7Q4F2KTYam378nPP9XH1rbdkWR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000028e46c9bab1817022229d3b1dfe8b903762dcf640bcd51c69d4417e417ba8c22000000000e80000000020000200000008f27467ae9913bdd78c015c406a7fc4e0921641cd15317cbd03029f55c475d93900000002ebf82f32dc1f5b995527f7811e85ac26534d8f3d0d7d6b26952f0ecc1569c0f96d7307cb9e027403f15ad818f4aa144757102bcdefdcce8b52ddb1282554224935c77a04a8a80c2c890805bd0a58aa3cd3bca78a68b299b2a26c10e7d8bd04352ea77b63d97aa7ca8051bc796757e8c5f2c46e58286fc82b8f4aede9fbb9d8ae2e4e0a20d7962775f1223ac31a56e1640000000edb6d377ea128fe5e84a4f71e9d7b7ceaf602aaec059c9d751a3abcf2d0dcedea2a80fbc32bed742a018bcf1d681789527426a056a9b6dbf7ba2ba99ecf817a4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC0F80A1-A6C3-11EE-966D-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000538bdc61cc0057fc40c70679bcf171c7350f3f4c090452558ca027c5598b1cab000000000e80000000020000200000007dfafa3bdf70fffd395b4e205c213962987f50e2965a9e480d63650ccc0464f72000000054af0f6076a6bf55dcbdc8cab6303fdcaba239e1b2dbaa5964a76d33c149451e40000000ee00f89247b10b84b6567a0f41daa0f69a6022011cfeb659dd6ddb8333cd0072ba64d80c9895fcb956c7bcd9a4a431fb3f7c5cec26de41641b5060acce8f5f67	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410068988"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 308044fbd03ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2684	iexplore.exe
2684	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 3028	2684	iexplore.exe	28
PID 2684 wrote to memory of 3028	2684	iexplore.exe	28
PID 2684 wrote to memory of 3028	2684	iexplore.exe	28
PID 2684 wrote to memory of 3028	2684	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\052a7702efb565458d01160702a44ac7.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf0c9ca10bf9725219bb7f6e602fd501

SHA1
0d8b55148f62a9731b3562cd2412e5418de72972

SHA256
363ee3ee5921c66d5d3160aab9c1b1022fd6419ca4285953d0438d81ccbfefc8

SHA512
7bf25d1534e7812f6ed8814af5c4a9b92642f67cf8bbcb02262ff766d01c0902e3f33ecead65d18e5f7facc5e167334bf749685c1e9e1af8fcabd5f2bf75ca08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d7aa4779a46b9dea027800da2a8857c

SHA1
1dcd693e2af96f54c56870d79393c482413aa504

SHA256
612ccc8d0de96c964f50fedd57255907b7191ff071a67e120d2909c9f4d7eda3

SHA512
70a5e966d9a3bb344990919f29dfcf2362296535b56ee626b210e0f1bd346893ff74f1d38fd29eaf11af9efd42b893843558011094ef6435dba3358a80e87c45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4958a5dc2708f4a7a41a74b59643b636

SHA1
7048200104139e3eec132a7ce5d022590c9b1c06

SHA256
72986914fc9adabefaf6dbe1f249de756b7e2fa92991eee2e677b55b5e03e605

SHA512
f5ef787aac28146fb7b32f8fda2ec7d2eaed6a00c1bfb28900e11bb29e0310977663d58e0e38687b74c7119f98c680c575eb26f94f39b4995f35f19fa10851dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
943391fe6642d05d58928b5fcd3bb045

SHA1
7a1feb2d3e511088b56a7e5561b1d39131361813

SHA256
8a0fcddc7bbb74edb4a2c7dc65871365d77bd80dc5ceb9d4cc16e383b4cd8259

SHA512
4039d7dfac3aecd54fe4c4699e3a3c8c6351c639d092a45845b7796c7814f0d90246d1ae9ff1a680d63ab8bf767656ed58bdae4644fce6d654c1f5a0474b11b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44ffc5b88462120a2dd9184b6df94794

SHA1
8d458e70d6da851bf7e590d2df268367f9bd89b8

SHA256
912e68c429c7e6873b7ae429ea8f339788ead36ca5df66ed1a438ce677f94550

SHA512
5b12cbf0f81b7bf6889ac4a0a197cf192c9cb9ef74c276cddec3605bcf42d521c785955789dab5e5f5a7024e79a9eb1876e5de62221056cf28174e17d69e09ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbecc81574589664979607c864384258

SHA1
a0275b2ed1f22619dcbfc29b7cf4fc6241daee6c

SHA256
ef2dd5b9b4829f313e10cb862af2581482057e86730b9325641bfef1e7967dea

SHA512
1f102b18d4285f3a0c80743c9fd7e919a083da7f880c7928b3aa496c481e5f7a7afad8d806d5b4acc4d78b535677882cb1dd04afb1efadc3e44726f411096097

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1136dd176fc911cc40cfb2a03e42b7da

SHA1
74ec270641fc06c26dead7a196716b35a236928f

SHA256
495e70b96e7038699d5f04990ef447b37ce035af3c23a56bf4af6fc2d4f39166

SHA512
0c814ecf4aa1be699a90b5ad431aeabd7ce98a96638cdc51ff8e98093941f3efcac2f71fd838db1da4f6cc9671cf6d9248ba94543b37f5748ae825faa050b26d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62cbb1f627a8d0e981956397b3b551ad

SHA1
471f655a88b13f2f0a388be5b86fdc8bc7dd1d9d

SHA256
c9e2bccecec1b0622df21b6a330ade80134f821d53da4cbf4f89a30756ca2dce

SHA512
b504dfe84dde4d988b8decc2926528334b33f1dd68216e3664657ddb2697a237731f4e574c102d634bbed9edf3753b9b319184a6573ac01861c329cd3e9e161c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47b8e14fad09b4fa4a5b5b81251a4cb0

SHA1
ff34f3635e2c127182cd1a1d4a58298db66624ea

SHA256
0ef988449f68e9fe8d3142c5f6bd68ff146cc37fbd4de1536142ce08d8aa3df3

SHA512
c22784372b5bcfaf6abef96e17e5180e4864ed54c43e68f18561f95a26ad7e19f884425d503579be46ef336bb24b9b955c54b690b542e7b5df34ad6671ecedc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74bbfa383306f6069e273621fc3b28de

SHA1
623d9dba88a768ee0bf55ec471407eebf44394be

SHA256
b7b15d89cb820219ed8da053a92e61d6a87050e60f470904554731e098b34dff

SHA512
967e218bec0ea7212b876dfeff4c81f6260c8bca76df0a30133cde49ad5a04ace609b58377cd64f3303bee9e83dacf874f83f76fc698cfacd5f55e083a3da546

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8EE7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8F76.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit