e0f19ff0b31298e6f4cfb13f79d74188ccd91add6f24e51da4494cfce6ea3055

Analysis

max time kernel
119s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04b47669db463b0dcdc5d7d7d74f20f9.html
Size

13KB
MD5

04b47669db463b0dcdc5d7d7d74f20f9
SHA1

516b2e6b62b239fd3bcdacd57511e79369bcbcd8
SHA256

e0f19ff0b31298e6f4cfb13f79d74188ccd91add6f24e51da4494cfce6ea3055
SHA512

39ede008bbcddceb9ada541b0afc4aeb5099cd2ea737a41b4461484ca54347303c407b6d50e82f48211db7a7b34220aa566cc02911bb4f2cfcc2c07033951497
SSDEEP

192:JuU5tMEs3ZW6S7ns7g72w6rg+zBv1B//zS8dX/6zUYimYrMK1v51haSvX6dLW:BDsMSLT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410081934"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000915c9b19a5e58ade964a8a4264fcef3ced8cef6c754173a1829dcc1d07af9604000000000e8000000002000020000000e95d5df7dc5a4865704d20d3b49c5c4e939ae8c5ec18cd464c6595fa6b79f81e900000000eff27f0896bea70ad39fd6d211225014c4f4705c3415c1d0cfe20c1931887b5572041305cc206a0c0337b5220bc72a128d65efd38b8719303c1e4a587ba3e3c419c73bae67247887fb679c00c3c6675458a121412f13de9c952658bb81f62600021359c829489f84a5681045bc80a0d183df6cc050f9ebc4e16947ee1a4264ece5dc6b72f66847517bab9c66a69815740000000060983d261f2d7e66a94496ce3079c7b31b42be344c3a3810367df34d87e7778ba4a5a647a02cf29c2cdf3030b7536af0b81fee1b990b7deafc3c1b4235c0dac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EE76931-A6E2-11EE-97FC-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c9e4eec2b310b7f37c9e5f411e66b94ba4e3611638fe4f25bfbf57c17f011e06000000000e8000000002000020000000fbbb28a55de89d3b25a085989ef76f1bdc27ca74d960ab930a5f9dd7d23a2f4420000000323dd0a40025abe9d3bce7cc56744bdc7ae34fbc832b68e80fc1b11e81fa1db340000000c5d6c98e408c49b3cd957363788a3317a44f2a4ec7da4ef5859da778062e7e354b391807449d902dc5250bc49e5cfbc2c7cb03a18cdf2ab40ea101e0c1cf2d52	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506483f4ee3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2444	iexplore.exe
2444	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2732	2444	iexplore.exe	28
PID 2444 wrote to memory of 2732	2444	iexplore.exe	28
PID 2444 wrote to memory of 2732	2444	iexplore.exe	28
PID 2444 wrote to memory of 2732	2444	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04b47669db463b0dcdc5d7d7d74f20f9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1569603e4f884a47b7bd1befd77ecf7b

SHA1
0e88a12ce0a92d65ed350a54d575b34944826e15

SHA256
026bf4af611bbad942087a856be8ff1194fc6626decbac8285586647562a6477

SHA512
76b803125117298b9757860b1fc63b08f7a59068180d06fb980ed9554b6ed913b8a8ef7aa768f7373ce981215a54cdfff621f3c9a73b395e0b53530d54f52cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4eb0812b73a5e3f18c4aafb53769c48f

SHA1
7b168bd37f113e672c208415664aac46a22eab20

SHA256
938144fcb1b37fd51b44b4c45fa05f463dad412cf02eb7d0d70688c4a07a882e

SHA512
66ddd999bc701c58b59a7de13b305aee076a788118da3e0ea2ea5e822b9127c2d5c7f36043069a74da4e57db77abdf33fc011f7984ad806beb2ec35eed4b05b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
672d1deb976c99dd2048997b21a82abe

SHA1
2bb74ee6fb31a276647aa3c32ca50455c1ea417a

SHA256
9d6a7f052ce5cb8ea25b5da859a4bbcd45067d91ff11c623b85b349a0bb556a8

SHA512
74e27d1aa8853a38c6bff54da54e4b10d77d01d33dac716cfc8d4aa4ad2ba8fc5ab8e717c2322ccb5118a199ffad72ce313e9cb13bedc76dfe2d98b73e932f8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9af92c040e9fe2b4d1ce9363b15a7584

SHA1
c733ccbe0d24fe4e76b7cba4998068d54ec735a0

SHA256
50edce35e9a74785c849b6c33659c2e248405c5825def953d83ecf04c880a42b

SHA512
50496c77a82ceb9ec14c230dc330617fae68fd666e983e8e05155f30305836fa205ba4f25363a02ce0354e902cf71acfe363974f9c450d53b9a26984b28f1e1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d80a6ee6a1294243bb2c57e29732cc13

SHA1
b111ff16078b6d3e07d1853cf77a432982df07d8

SHA256
6e597f48036ab8f9263c2eec612530739b3db4302dc1b52b349935df91edebf1

SHA512
d91e7ae81568dad840b51d4706cdcc2e8bd925ae4e5c6c56e4c1f802b8fce34af541018e01282bff8cdd39af08ab1169d0ae5766ba26c86207aabbb92bab60bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8be891c808de80410710f99f305c897

SHA1
b713916cacaa3cadfe391b0286f0ea86fbea9a53

SHA256
d67de481abb190b7c1c98eda31e58af5323a767f22d70f024ce5bebdb307876c

SHA512
c9ab25681d442ce5bbdd74cc97f521688225f9288ba1186ce2ad332d4733c403031592d3a328f16d38a76171f1cfcd124c85ff776cf462dbb3f24ba7da7c7611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a440d6abdef19d9cc928bf5f2f0585a9

SHA1
dd428da7ac5661da497b5ddb29d78ff056393641

SHA256
60178227aec79b9dd8b56d01fe25288cad11851882e3f2dec8264834b9049a29

SHA512
7e4e124c0b8715a5c2a73749f16db99ddbe93a56e061733c388ed62256bb621fc1e30ea0afb7ddbf29b7827422105c91904b4aae0972edbd2eb31e12f774c824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c3f409642a43b9a5fed4f42ed0d7db6

SHA1
94cfa1d8348f43d717a49e5e3a0c62d0c4db8e00

SHA256
84bf19a9404ab9721972f1355552e0f20bd81bcc872d9a291c88a80eed8e5774

SHA512
b9b0f3980ddc1c29dfc3bad039d8e5156089382eaf006e8f1751c6248f4ad55987ccb29855d8cdca16163e3f9285eaf57450de43fe566fd9895a5f7f0df9d25c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c6c4d1926470a4dde2eca6accefd383

SHA1
6f9d872a0d09902acca10ce19c8bb63e88ac726b

SHA256
5ac7958218b009eb57befaf774bfe02df61fec52fe22c5c0eb49874dc21612ee

SHA512
236fc66d4e5fb60cd880dbbd2ccbf93a919b848e849f64c16c422845dc2253154c26205680f1064070bedd67f3da5ee57b343143e6d0d48c1942e8c534a47b52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19d42a2adfd542f764fdf22cd314aa2e

SHA1
21ef27079749548288fa8962e2bc0d0f45282cbf

SHA256
ed0ceeaee7004f35cea29458d5c3e02cd4c419f0e80aff1abb6af91c3acdf4fa

SHA512
5192090afb3e356352ee61b4368ea2df254b34757030fa7aaaa653060c9ff144b77920d33dbdeb0c98147c93ab857de6ccf3bed88c3106868d48d6bab7ddc6b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcc23630dd9b436aa6bb65443976e22d

SHA1
044708313b5ebc757b4a21b87d43f20decfa3dce

SHA256
d9ce01025eddcd920081e477f8c89416f329e2b9a9faf5c8c565447fae1b189d

SHA512
3fe0ea586df675b9852f7be5b7e97895fd6a243e2d567df2bd7f762a6d6a58a4d3dd3e5aacdf8930e3365c6b79d603cdec8eed07b4004f4555ed3974c435f0db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0d0348cadceb64624b46e82471d179b

SHA1
b766035adf6fd8f85dcbb1364b3e262e0c4dbe86

SHA256
180759dd9a52c36b4e16c2376354f7ad7dbe0cc34f0a922e7f8cf8946c0e8ed2

SHA512
a353e5d2e15a1363abbd78edca94fd3f1425660b6d88d8fec0a5740d3e35f8a0b93070564f6c8c93d4f67cac8bfcfcd8107a4e65e99af4602e8320d8bf07e0fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26552f1b195e4059e912cf0fa94f572c

SHA1
37cfabd8c3f67a34ef6f4cc62c9586ac7a81b67c

SHA256
b3d776f1f89305e92b461578672fd24d327409dcd85cf1b5982caa874c67c728

SHA512
35f9121192f353d5b6ae9feee97d39315104c521388937efc75cba3dad574d89ebf05876a984535057b6964034bee67c08995d5cb8ad925b949be1afc06ff90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
238993628b12fd3d2e91b2c5b0ce7756

SHA1
4507ab58137a32df58b2be8f601305b040340ef5

SHA256
9d5d9b24369a16b5df595681f8fa27fd1568061f84f124d9a3b5e0990998f429

SHA512
2767e6f92c714dc657d25f38290bb91ed9f5dd07caced059b26a17e20cef55c090eff530d928e5a0b62ec57e25fdf3dfd30d90bbe3a43144c42c1b38769eda62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab82A9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar84B0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit