f043b427e456f0a8024901bed57f31128361b449a19e209b79c55fe96a6bbbc9

Analysis

max time kernel
142s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

051c3e1e4d1ebf710271ecfb6543794f.html
Size

32KB
MD5

051c3e1e4d1ebf710271ecfb6543794f
SHA1

2d8131abd08794085df32c6173947098875d75df
SHA256

f043b427e456f0a8024901bed57f31128361b449a19e209b79c55fe96a6bbbc9
SHA512

5d33d0e3674c011061e6c9d7df7559153c23d38334542e61fbed7562048526745cb416184995a442ae6c5392707a60abb9a3024dee44915a1f6e8c9981c25a5b
SSDEEP

384:SaysBQFm03QYQXrw6tdt6p8zTuH6PlirPz5jk0+6kXeVDTD97nQxFjbJqMnNoIxm:SaysBmQYQZAIlirPz5Q0+o8b04x9u

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000076ed3d830028b5d73e869105de8df857d282bf54796503c4479edb87725d811d000000000e8000000002000020000000af9f16f3557adaaaf734a45d1fbd25a3ab275238fa97d7273b22569f26fa3a962000000037fe0859461a07cb75718b711d5b46788abd098e64db6dfdcad85aabb3f36e0140000000896779623424244487a200a0884b1bbbcd84a1e3a6326ec2beccc58850775164b27a1dca2993fbc0c65177d83c4fb4ff5ffa671cf36a874e43c19c5e840d0bf9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000005f9793ae2eb63bf785ec617f308afc4850a21f42e75432b210a7811aae01007e000000000e8000000002000020000000fe9a48594ec0e45b843497823237aed2e8d8ac8155b622633366293a98b0658590000000442ebc58a35855b9b7d7af339237b9e9d0d9b54d91ff5f21132fea8664cdcf0f3f33243b1b94850574d38f1f1730ae39caf934fd9cc117cb232b77181a7429830ac8a65af74390d5de0cda771b6040da1919561a9c3e30e47b2133167873dc2b43967840c184f46b92f3657fa955802e0bf0e1f97e195645d6b3049afb213ffcb7ce4dbe7a169fad6912d396d30435e340000000abe0b06c6dfaf0d5ab269bbf0f1fdadfa0d30e75e3cb7ae97f2131db1ce872df4e1c80fa3ca30613d77f5dc870ff164a1da4b515a0b33b1cef5548f4556739c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1EE5A21-A6C2-11EE-B201-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8058d6c9cf3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410068539"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2516	iexplore.exe
2516	iexplore.exe
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2256	2516	iexplore.exe	28
PID 2516 wrote to memory of 2256	2516	iexplore.exe	28
PID 2516 wrote to memory of 2256	2516	iexplore.exe	28
PID 2516 wrote to memory of 2256	2516	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\051c3e1e4d1ebf710271ecfb6543794f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8759c2765a5facab2a39feede2c091e

SHA1
f9fd773c5c673ed6c90bab49c9163a99ef73bee5

SHA256
39f28d62779814854cb69e745e6cbf8531c056d5e921aa0da6825f945132be81

SHA512
7d326947308f4f28da9e314826db301b7eea952249a89f3413b0473d332d3c763564bb58bb1be27e82daa433f31ba119e643e2b06af9a65336ea15c6042a4817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ba96c16fc6c1413541c6db166b36e26

SHA1
2a0d9ef0da03d3ac4443962c59e4135d7da1062f

SHA256
45c7cd2668db633124462c5e8099739477315c828888b3a0f002064634969dd8

SHA512
65a3a8cf8258ff7bcbd696eecd07edcc79a4592bb73dff808353959762d582b4b69ae15b439bab75686d56034d0a0170b13f5be27e3918480143837f4b435c77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
416429adf4ca1d12a7fd550b9d5cade5

SHA1
824c97cde69ba7f61d0c7dc065c649a8a7402129

SHA256
09c4cfa5928c4c2a8410129897349833fb922acd67bdf18a34e5871bcf52314d

SHA512
497c7645ebd3fb3bea38186ea8ace76ef473d0f62b9486a0508bfb18623fdebe599c85533da13dc0550e1a2a2cb89f1933a2734a07b0bd7db4c84f698a9745fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d82b53d2a8774a1b83b29b005008118f

SHA1
8001f24802ed4360580b9cbefc34ae418afc9999

SHA256
eb048fe811d80f6e41d58e9b5d83e21f8fe2fa4d6675d6526c61827fd9712891

SHA512
00473c6e0a47ebdeab6241fd1bf810a343cdf106db26f1d16a605efa3b21bb67af1405e050802644da822ac7c2c6bb65ddb06426390d351c340d8793815f75ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e9b9e27782e5ada0a1e6f89740693c1

SHA1
8724479e06c70ea483da33a1a6468dbe5339f1e2

SHA256
da71e312427aa549f41e47e360948e2b2ee0d2acdfbe0fafddcccbb0fc675d28

SHA512
258e25463ad974b82972d92a66561b76ac011b60df6a665fb24076379d21adfa86715a20cf1c032973ceb143869e2ba6108960c5799a73b2915a046b8152c48c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9789b033c01db3745bfc60eea2abb18d

SHA1
3142e0380934f02572db49fcb702940165c5181c

SHA256
987b891003041298c2972ee350476be030c20b902f402056c453e3250d37888a

SHA512
cb80b964fa8d664afd7dabc3db7531625c2288b390f03a8bc3c76964792a5f9540025a985b3eb1662ad8a983ed7a633a589e36328f6f934ccafb9bdde551baa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37a3e3cf6b9fb6e9be46c46f2d7087f4

SHA1
e820ffb9371873acea27aeec8daae1b60e7534dd

SHA256
52ae8af949a60ed2257d97aae326f342d85d16bd29f65474f4519c4fc693a754

SHA512
b86e37ec1d0e557606e62a82c0a6025906663f5c6006f708a05274f249373de5dd8ff640816ee3de393ef0da8f70164f530016c4836a9ec98fcde5b64fdc283d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5de8144c480bd114693450735bac9390

SHA1
93f7892b01e48278202fb3afcbc66fa1ae1025e2

SHA256
457bf027e60129427cf6b83093029f644bfd02c449e873914898963373dbec34

SHA512
d03c9360327bd00ca50e13d43dfb208f093f88c79b8e7d3554964d66e4c2a8967a1de83d666975cb946b27f985d76f23865f8974952913c2865dc7425a3ad6a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
add82657b34389e2afe119473188ccfa

SHA1
c7512204a59d1d5770658af41dba880e9486329e

SHA256
a85414205e4c486b30d40347f7acbfe934bfdd4c006aa90c7361bcac128e987f

SHA512
863f30b15ae6f45ab9ff410facd2b624f06f9cc65de423e3d0046921910628353ffb439703bedbea4d2f6db48433af540a63f24e78025c3b5cd6d0cad5c5f90a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40bcebd6572fd934fa25527b19bf774d

SHA1
0ddec7fbe06bc00ae664e00f0bfcca73ebaacbb5

SHA256
ae125baf768556b72b721d0e61fb2bbe6dcb3a1d001f5cd2f919db097f7e7a3d

SHA512
4f7501bab38f81856f0c83426d34cd0bb7bbe19e1129cf7a43978c6e77896f1b278b936c7ffc44091612cd206b90d4828602473e6f2c79deb25b9a99b07025eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85246db343d629b143f0b729ded9045f

SHA1
d73e5165e956622cbd3c3ac6648c360d22428a31

SHA256
80a0842ab16701c68edeef0ab920eaafbb82ec8c49758da4d29aa1e9e693b343

SHA512
b50b9dac8a7581c40b9e3afbd1818b31269bb73023f3a19e9056bb82fa6fc77450af34f458ded738784d0e62efe1e57a1aedcb08adf2dbd416d9cb2169cc1ca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64c54140ce2f9e85725053fa255f598f

SHA1
05206d70dc3bee9f2b602938f12a7d838bf9968e

SHA256
b75e8a94d3c119083a8056ce267425ba4b300066a002dfb69ebb10e3d90efce1

SHA512
7da05c046460b14fe5ac100905e5ff873b74d505590b21c8cfd4593cb05cbe5c682fa56ef36f155e3bbe511c5b84c5336ac0c53e39abb0c4cb234a98b603dcad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9889.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9EB3.tmp

Filesize
159KB

MD5
a78a31de05476eba2f0372ef2059009a

SHA1
ceb986807d0bfa9b80b0284fe0207bd7796a8304

SHA256
25f714381468cc0952bb19bbc596abd39955ffef006413a2f21df8acd5960144

SHA512
b71b923b059f851a0a0aa812ce898212dc3023f4678bd4aebb1398ee3fe6d55891a378d4466cc8c7011cf0e450616d8ada3c75eaad9ee8dfa3e03a58aa8c5bc0

Download Submit