e029018a7b3ba5372a2d51e91691378be8898bda07701823b82c4d4c0a9fb755

Analysis

max time kernel
239s
max time network
275s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04f8aa14155c379e35172d544c6ed5ea.html
Size

41KB
MD5

04f8aa14155c379e35172d544c6ed5ea
SHA1

9ca34608e1bfd79c2cba976c014f5432fdb88771
SHA256

e029018a7b3ba5372a2d51e91691378be8898bda07701823b82c4d4c0a9fb755
SHA512

c79626ad23d48acd0196d5b9b843f23b8e3f9e836ec8c7a52427692dc185eb503354171d40a09b56c91f87cbad1df92b4a30d8460d70dbffa1e703134544f372
SSDEEP

768:SZyyWECGJPTIOuF3SQzUajNPehPmxhhcdajfGqqa+qDVJIzVSs2QlsLoHGKeU8:SZyy7tf6SQzBjNmhPmfhcsjfGql+q8V4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410067726"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05C91050-A6C1-11EE-8AC5-6E556AB52A45} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1924	1704	iexplore.exe	28
PID 1704 wrote to memory of 1924	1704	iexplore.exe	28
PID 1704 wrote to memory of 1924	1704	iexplore.exe	28
PID 1704 wrote to memory of 1924	1704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04f8aa14155c379e35172d544c6ed5ea.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a092804c093e849e8b906cce300cec9

SHA1
d4526cfb0ce0242b639e094ce60b1c8dab10fe47

SHA256
44d93a525d41bf235f56099a2009a7938207b4fc68648340787da89ca9c86a3f

SHA512
e9a6e0b8f1103575a71f98d9823603eae06f93075dd400fe46e35c5d690c7458cfe160f2deae1eaf82a5ca228b92591bc1fb806fe41420985fdd37d0e32c3d27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc86db7a817dc04f7e902a26645d354c

SHA1
fcb28b14349172350481fa53707cf515e0d09126

SHA256
883c996db5e3d9c2d66b0506937d6b4be050f1f0be3612e73417671654174358

SHA512
3ca843747c1a78e833247a8b028a88ddb18f9b9845f77fe672f073c80174c189dd47d53b5f3b29da0b7fecc2852637647f0cf6122d5bc048f2c5c4d164577d51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6d4569471d1654423f4e43f3f735ded

SHA1
87a7ffa6a23bf3913f456e50b33176f863596e9c

SHA256
1038a002b3ba6c21192088be0f3a1f1963249cfa60b970f6a92cb274b2edf596

SHA512
1703cdcabdd421d79aa688c3d4efc587cef1082dd5eb04bc100af381c9e8c3a901fca9e3533ed251646c3b1cdc8776f3faee684626341fe0f871bd2ca8d74637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f35f8f2b812e8aa9f46a0212a9bea55

SHA1
e5c6fa8a9592f24c779c2360dee6a289c9a66cfb

SHA256
688989d32b08a4734ef80ce3798db558c2901b380c986da1a7a6408179076da6

SHA512
7076dccb09e677481efa77fecb614fb451e28a70c67355c6e4b85c8cc6bc115e96930019f79687d545de5a9b348311ae3ce5ee30e5c52b809cc9b58dc48e07ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7bae7e2f94964e58f1c8b966ee2ffcb

SHA1
a3514d0621a4e3de7cc1c0167499383ffcbb6d97

SHA256
f252f401ba101338475f9e1ce79a6c28631c2b4b54f2d4d3566a805513bdd037

SHA512
5675535bb83e2b410275852196dd0a59c73d025d3ad68d67f1ef774db2b55fdcff5267ec04831e370e3c104b01084a3c594f6be064469e2e7fecfa3f10058712

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bce61da79470300d5d3420b78f2d43cc

SHA1
84a776a7257976f66fa601e121aa3fcdcfa3d770

SHA256
c92e94160623dd61a4ec5258d81c367cffb47593a0501aefb5c3542b8a2f7f91

SHA512
15eaf4cf5423787ee3154cd70c9b859be8fae0686bc20386d07c4ccc4c19702baecb4e068fe79687ad4736782b7237799f3e75b62562a109273b580a1cef4585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17d38bc9247cad7d76a9c40d619c6c0f

SHA1
a668cbcbbf0efb5e1d52ac6e0baf5d5102d14cca

SHA256
49cae1e3e98d909f449e5aa72383e28146785e326a56b8b9ca6fdb933e468413

SHA512
55891bcf195d8a349a64ccbeef29506c31883f57922b65ea95633312e8683b3f0619a492f32647808ea98b854e1bc2c54174e6671cf5559e3633c012ad8b041f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06aa2526e08420f0b46372c6b75b719a

SHA1
fbe3fd38dd410f0bb35a3d7a94814ac5cc5ff853

SHA256
83f8e688a326dc0cc396becdfade4f02e5fd4f1cd6a69a862a288cf71a520ae2

SHA512
677eff28d56ddbc34a169465ed5c52cbe9680277fbed865d02697c2a90aef82b79ac054b0dc1e74af819e2b119d3d026db6afd7cfb62dd4e5783c15862bb0f0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e36e799c69631ff4f37ca19fc2a7f42b

SHA1
fcbfe17d206edcf33ff692de867c10fdf997a18e

SHA256
97ca22441de899ac31c0e66ceb4f06e64e502279fb7ad9a0456297169d74a061

SHA512
cb04e7ab7a5091be872c6fa644e6cbf198283acfa2e530572a9ae419f74f8bc25bcacc2e6f05f00152f86e640166c92e5717061606e14988e8355c212a9cffa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b982279058b167b6b27e86f870016979

SHA1
0e75d9b1c5114f4914ac025cf17fa84dbb1e1162

SHA256
8d604b93b42994109279687788de6f9093c9f0ce2c6e53ae4a858f3f73a907dc

SHA512
1dcc4d3832bae75a803b0f55d24bf205e8d8c3b2f047ffafa3cb149b388ec9beaa3867d9b8b88726e273b96d6851114734e292cd07a13318a7329f726be1b77a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d20006801867007ebe7bf91607d2a01

SHA1
743317d0cebf03d2adf2e5b535ac41bc349784ea

SHA256
a27abd04e020a45c4b4088ef75746f29aebcbfe086db1d57c704e36787c277d0

SHA512
574c2003645f8643cd7f58dfbf47faac6120f4ef2ac560633d0400976eea3efc5196ba57deaa81cf30778fe4fc14cef8fa3d67bb407b6eb9019516fb3f04a938

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e30698f5b9c187e4e0cca5115bca5028

SHA1
d92aba920f84044a3a86766d7a19975a824823ba

SHA256
937cd5911e5b06222698928846184de0618708e70c25f67351c2556f9567b594

SHA512
c7da32a8c429ec4682f7d4b19732bc1b6fa057590791df019342cb3b162200c55817db082bccd91185282696ac1fab5c8f4dffd28f6497e8a2126d9f2148a8e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c11339e4ae082dbd381f8454fc45fb17

SHA1
30b3db8672679bb21c38be6b9c0d729880480cea

SHA256
9c9b9631160547eeca2653ca102c63c649ea553050802051e1dc252e50fbca69

SHA512
af866fccff0f246ac575523a02bd19d11015268695a62fcc346ef18af3ddc76de84515f5f4d0bbc7e1875541a092d8b31ee9551d59f93ffc008e98de10d7213b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60c2c97a6a3d52baefda015ad61c1800

SHA1
a0706e43a676760f11a199062a102a10276ed90a

SHA256
7df8df6a1f0cf1fdc76d56b5bdb14856950eddea941dc670ed056db9946935e5

SHA512
cbcac82fc1a1321a8d484ad846ae412724a0f4285748ab6b35a26e0cfb4a01f1b10f555aa82bfab06153b2bcf427bb0e3758d95bed6d634355402128b1a32d14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f8f519ad304df31a0af02292b701b94

SHA1
d60463aa51b9acbb7e7a845b9facf058dcb3af68

SHA256
5500af5d95c775e4709b4a77ac3e616ba25b19c0a277e5f6f33dd8988ef59fdd

SHA512
f41316070e0dd63675f941565b5a367fe9bca597ff3b24b37a92fb2b4e1404cdb3a7a5e1e1fe43162ff70d1c4490fb0db0fa65a0bbb3656d1e5a9a80c3178193

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c03f4a387705a4093952b95945cd2c5

SHA1
a98e4c6764cea2cbdbe5170ee72d3af8320a8a8e

SHA256
ebda0d0c60807afc9ec10dbe6ce32d6226d4c6896074b6b9c92a6eadfd9ba173

SHA512
65bd7a5e179c59a9f90074594bbca28512634e5a368518ddc0a085cc9df5a555c0e4881616f55892e6a85285df2baaebaeb02f20599716890a8821ecdd55bb65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b103b450cad300f24c265ceb4f61b34

SHA1
828738683cced771ac090d3e3770c1a19d93bcb6

SHA256
95ff4c5a364bee00de119cabe2db4509957b4766db91257d78272aafe5714600

SHA512
e6d842aed3a50e566da90ba3f8e59941d62d499b3b0f4a4f2be2559dcd7be9b251f802befcba31f5419824bc21d8dbd58644e576a85eb9ccd6d5125c088d0705

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6644.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar66E3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit