e8583925b2e1cff00238dbe8497bf667a115bb66014f9ff9ee0770c787348609

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

050a798b17f00f22d76f91a147970998.html
Size

19KB
MD5

050a798b17f00f22d76f91a147970998
SHA1

a76f2a0b7142ed5b4f980374a48349b67c615a09
SHA256

e8583925b2e1cff00238dbe8497bf667a115bb66014f9ff9ee0770c787348609
SHA512

43a8cdc225d7ff495e2f15d4a4c3d6549e684f9582e35aff056f17c414e9bfd344de5a910b0433c6cb740e09a80037157723e832b775c754852918a085e74188
SSDEEP

384:EXKlIc4tE4CoGTHkAoK3C5ptIt4R43PhIbVSa8Cboby8ScHN6Z8R/gbpgOXguLZ:EGSAoK3CPtItGmPhKVSa7boby8SZ8hg7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410067919"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000024464209ab410fda376437db7a280f7c843006e05dadd9ffecca27f2ffb0721c000000000e8000000002000020000000a8c34a27f8713b502f9f35125945fc15aca535501092d8466d5de0768b2d807d20000000b11fd1e5fe028c2cb2a0970e0565a2044d3011f2553b906c5df292a63d05794440000000a1dd401599566cac6132afae1755271b818ee610f2f456052fc1eb45d2400987da0ec13f09ceef846c1f1687ea06d3155938c9f00d24e58f43ef02d31ed089fa	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80AA7DE1-A6C1-11EE-AD90-F6BE0C79E4FA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 903f6789ce3ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000e0922aea1d2b4c34842d70a9fbaebc139c729c3cd7c2ffda4945498f9b9b9f6a000000000e8000000002000020000000d902f37b70e7445d0b5b99501a7a63b5421537e389b1cf7de71e6b4e9b364eac9000000078a8a3623ff5e489f4542d31311bc7db4dc8c2b32eb3f13644fbb2dd7fb2167ac6b286d28553b1a2112b0c64503719a904e62ceac4f8b01ad2338655beb55d0364f1216f404bc446a4c09be32d489725fda5adf8c19b50a971b729192f1641df135499df06f2ead193dcb3dfb3f79e19f3a0bc2ddac01d34d03d03ee8627a1074d65397dea3033d8d24f7513857c7f3b4000000040a3911a6ac06c643c7123b30117d12fc76352000e4f72e2bb2511f2af9640c8edf3abcf0279778c62c75d10fed1e0d734bd76cd7929608916f43dce6c8e03c9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2076	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2076	iexplore.exe
2076	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2520	2076	iexplore.exe	14
PID 2076 wrote to memory of 2520	2076	iexplore.exe	14
PID 2076 wrote to memory of 2520	2076	iexplore.exe	14
PID 2076 wrote to memory of 2520	2076	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2520

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\050a798b17f00f22d76f91a147970998.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b2d386b1841f05ce897d67f0a1bf84b

SHA1
021444623bd57a3f4fc7b05aaed1881bde1f92a2

SHA256
5941b745b39bca7a7ed19d411ed8e25b9bd5b40fbf3eccf4a8e0711020b139db

SHA512
6eadc8489438e1d055b238a9b944dc298b7415489fd1c377359343ef1a1daaceb5399dd187e199e7d4872bc70d63165cd57773986fd881a718069bd8d913d11b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea3ae218cb716fca019968eca0c21c51

SHA1
eed20b575a3526d65d5e2ceb80075ee04f2bd587

SHA256
034ae38cbcdc690efbe8bd253a86627d3d2cca263ab9955c595437aafcbe77de

SHA512
0c9fc978c4cafce67877a3f7a96c08437c30e933f3ca1312ce3eb9626585d5ee4bc93fe71f772a679f90ec343c3109136b673f2f10561137b86d02e7a3d537aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6669d08a023ca22e294cfb3f827a960a

SHA1
ec3db0d041e2a26c6e3f15a9f38f41c63c5abb63

SHA256
c99ed6674e423357b5681733d1d4fb229cc96a4c6b0ef910922fa59b8063b39b

SHA512
cd0dc304a6341d5a44b38d4ea05cae05fe483d2f83f3dc5d6974b1235bd8ef914fbaab3c8cd4e45d6da04fea65123515efba0ca9409278f08f0e08c8ddf296ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a2c9e618ad872a5a435b67a1f61253b

SHA1
0e255e964210ba183660c78b2e9518fcf00c4a96

SHA256
c69d376b906ed9f9697be1ea4f0ff6d071ba6dd218e79747a3f166abafeaeac9

SHA512
d7734e3692be8696f33fbf42fe8b28a255df88408953d4bafc22dcdb3827bd35202708b7c66aa09b81b7740beb6b5f5b4846a929de83baa49df9b7767710ec08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be9159007021c7841afc316ef51433ad

SHA1
fa565e3b76d05627bc75922abfd5e50dd7722f71

SHA256
702e737f1db33fd45700e02460702fe64671ad40d44347a184e275f0fed9cc69

SHA512
de2cad06f37cfa4838d896ee7fd917b9b50ae213e34e1f1b0b70c1c88ee26c8604e3efa7117613f0fc59b86dca86f3f28124e897cf8a86a93c91b53a8ad74b22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13ad453b72c76fbc6c5433074f3bc650

SHA1
afc9ddbea02c10c2b76afeb6ce7e8a93d65e7b86

SHA256
0066a8cbee26aae7de19e42f2ff1d1e049d404d036cfb4773e1d7b4de5f5db7a

SHA512
fa0d2996834df269417790a0b30c5b7bb5bd527a4eb017f41850eafde9173cfd39a4599f1c8ef6558da328c686b672423ff63fafd24f632c8cec31f8f48796c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da6d6091efec7e59cfe24aae5c6a0e0a

SHA1
e376d3fcf8fb237385fe69ccdb9c18e47f9f7fa7

SHA256
56f931b478cf89a6a06b5045a6d7e8306e5af3e98985c4b99adf95782ecaf838

SHA512
82f45f11d56081e65d59338f81658e35033deefd1ea066a9c24ca9c895a95b050795cf2bd1bc8ed516980e6115ab2dab57de52e19045107333a161041016d0f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d03d288fae32a5624a5ef188d4aa8042

SHA1
ca9fc9185086d1550e0a5271b4078e5b750f5857

SHA256
dcae4d58ca8d753ef23859bce456f3417b48a08b5dfa87277b70a8e45b0dc91d

SHA512
260aeba8013a76b88b9fe9ccb102d51950d7ec7f425f5978dc881bf5664d2e897e3bfb9af341bd4d2fe8239b98f9d35877e2f4f7cdd2911a2fc4ee6ef8879b1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b28a7f488c2d5bbdb5eed168348cdc5

SHA1
efa6286523713a1ce947f528c54d17b3d1476fb0

SHA256
c75d5227dea72dcd21ae28f9d7c3ed2a90a4105c1ca1d12a1a1d58dc45f8dd08

SHA512
e0515df1ea5f9dd9c683193412fb132bca6fb1356f80bcadc386d5ff810b604aeeb1ec62559c6ebabf7ec073fd0ba0a1f4e12d08802647364d5f158284a9f0af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84468ad77b8778bbfef1e0f41559f83e

SHA1
50fe1f5d2cc7e103ebd256fd9348f35356befe65

SHA256
c7b298b0f9849afd4e8356e46d27efbabd35703d32047d4ef3721ab987b86493

SHA512
8745ca675cf5be20d3827c78f16fd32c3660e5ea63118b6fcb9f4ba1a7439f8e227f4d8498878acbbf0b944ad531dc9583751f327631ec6c95eb0fea6abb7733

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fd9ff768d17eea70f5eec0c4e734d47

SHA1
4571daf9c383829a40433e6f901cfcb1bcb1728b

SHA256
2727e1288a598f47f1b09e8112efcea38be3846cd2f144e956209ad3adead175

SHA512
de3d83078ef7b6ce00950040e475fce6ccd7c7da9157eee7d4fb2dbc2704cda626321c504b49209874e144a9f8fe2e68f675080132e78e31540ec8e1026c2535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66bce2a6db40e37b0d214c549f08bd30

SHA1
d01fa5bd2f0facd7df4cdfbb10184a3129dee849

SHA256
f3403179fde04735b82d4486b1fdca0a9ed34c521540cafbe9ef5ae56025313d

SHA512
5ddf4cad3e4985d4387562dc06c7d846725c19d2700b783c36b65c2ea02cd072e60308d3adae2f032fb87d9acae1443fc0c4529b96fed6942d564b683f2e34b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
389501d489b14aee6f6cf274f58101c0

SHA1
6f582cbbcff3da6a752c3d9cfcdb8f6a38a15f1f

SHA256
786ab89efacad6dcdc2fc146a1b2562dd25b48dea569cd8bc18144f4eda7e093

SHA512
d81e35acdce937028450ffda65ec8732c1ec24b2ac756310d810f746e2d965e22ae92dcba53d2bdd81da7fab810dcc20d1625108b1d475f3f5672e74a708c265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
632d8888f3db50f80f8e74690bfa71b2

SHA1
139be1e2b26477207b164e47bde98aa3b5d58934

SHA256
03658b3909c7d35e6f5e1eb940004d3c661c061c5eca20519a883ec290970e3e

SHA512
27916050e65e5f1620f1b7729c6c80f149e1d280a9890844b96401202cf340782af07013ff02d59a9eb1c1b5412556b47754805c9b7a88af8341fd0566fafca3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fc0ffb902ce4f9aa50d8234fe6859f3

SHA1
9375239814e0f880054fc9c6c19a5448269d1127

SHA256
d824734323df2c4f0fd14c5060020491ef94ab82d2cfa254fc3a812aca7ec27d

SHA512
4550524c83806312be251533c6fd52de962775ce69ae371196b4a95225bb53dc5ae65d218ae35fa7713e81e7cc772be27f0dda7d6d7488baaf8d523c652180d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF71.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit