e1366ca7932bd8ec5ed06a03538660affaee7c65115f0ad090240f8ac0ed3f92

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

019d4f833b0f0ffeaf053ffbd9526432.html
Size

19KB
MD5

019d4f833b0f0ffeaf053ffbd9526432
SHA1

aabf3bbf946d2947aee5561a955cdde612b1e520
SHA256

e1366ca7932bd8ec5ed06a03538660affaee7c65115f0ad090240f8ac0ed3f92
SHA512

8d4392576e5982dc786d1df91f5a4f44b2e364c4272b6a95297df241d1bcdb5f4ff6952270187c4de33575ecf2067cb939008a42e11b804b5b6b11d30a88f460
SSDEEP

384:4+QfPFd9QZBC7mOdMwQtKfpC5IgSnbmFe7AclA6MtLDPd:Zcd9QZBC7mOdMwppC5I9nC4yPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000003c1c19a1c8b76b3eaaa7708ce4e1cbfda85c0486da8365d910f91796b3f53240000000000e800000000200002000000050e78853fb54a24864f4df12d4abcb8efaa4720c1b0fd32a01ee14a8e9d1f61520000000ca0aa21bf9e4b59ce43e225cb1961b03c97b99d73b81045f2b1feac10c828ff5400000007fbc6a307f4e4582dfbbd13fef5f35463eccfbe3126450e0310fcfc050ff718f9e85d3a8b6bb7ef313f55c9d6fe9ea58d22db9e5325c3d74b7c7216d4d660547	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000d569b95833a7bbd4e66266a7c3001e65ba36a445a192e6e815da54dbe9c2e01b000000000e8000000002000020000000967c99214633d51cb14b639b8e8349a85a49117c35404512943559098a3e1f5c9000000042c69106fec04ae3b3b6592828e413412262fd26331afc74162105dcd30e0421b184d2557febacc5a193a44e7d0250d50ec365d2d1034ce1c78da431173b73c911dad5e1401b9c04fa3d7b292a719e5448d691bf22140eaf9fd31fdbb8124590b2f11d618a3e7b92f0d7c3090f18800600c995bf6a3c2d4e232cfcc586ddbd1046efb574af9b18ab1dce9e45b71e95ca40000000b36bf61bd8ef7319c8dd37c6091b66acc562b75d8c097957913b60922327de9ddbca18349a3854a20caa47f03654f67cb264939411fd890f79c4b6e957eab17f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c05dbc618f3ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410040903"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{877B0611-A682-11EE-8459-F62A48C4CCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3048	2916	iexplore.exe	15
PID 2916 wrote to memory of 3048	2916	iexplore.exe	15
PID 2916 wrote to memory of 3048	2916	iexplore.exe	15
PID 2916 wrote to memory of 3048	2916	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\019d4f833b0f0ffeaf053ffbd9526432.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
5235df652b61c80ec2e75a861ba9f5f0

SHA1
150cea6b8f799963b329aab273367edd43095ae2

SHA256
0b398caf3a46b31e2dd5b775497a8f9cb78a2ed68baa42ae04e26ea6005f7342

SHA512
fbba21e647ee4a82ff8d00505cef56bf7d1b2b0f5a586f779bbcabdf5d701a799b6955f531bcc380877a26dc1a5789a974a53106168a5f128c6d1239e935df39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56bfb9200bb35bed6c0d25c4f423fa8d

SHA1
dabb05652e6d123442a5381f60845719a67c3e7d

SHA256
d287ffa8801f30f3463d84c9903f657b1b565da522b8198a399067c6cf1781d7

SHA512
724c0155a2a14bde447756aa1949c0d90525d0ac26fd7a9e10ce819b57ebb19a2ce4a0b236b32bda0b083c2aab76047e61a23b477cef2359b8e3225f773054bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7aee7e65a411c9b6652cd10980ca1e3

SHA1
648b0fee049674b670fc4efa796abcbfdfa6c5c1

SHA256
d9a0497bfe1e075028da681af33c0e46b14dc8ffdd69ae2d14ed0471edccefb2

SHA512
031a7f12971ca406a17da2827b2d9fb0c394b1e47ef352504ae457c0156949f7a0cdbcd527645c77a960d248f6a300c8655466c94c1d807fa33cf5bd83b5de39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf21e3673d0dbf61479640d1807e20b8

SHA1
4a1c830aaacf7d37d9ae3753c97147f81b093ca0

SHA256
a8f14ac5e6ace908ea147fc1336aafa95a06f71ca62ce2204fb621cbefc4881a

SHA512
e6e4ad1fdc60a1e243df112dd764225400dbe3bcea8e6b8fd5e03754ebbd993d9cb86aa7d06e1e30785e0e95f1bf6373f449186a12b792029c8c7b4a8bc5bc30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6da6edebd34ae33be9c14ef146b0f882

SHA1
e3a3f0d9ae00beda7501dafaae9596eb39ad797e

SHA256
809dce1c0ae41d03c86e6e690fabd874155726140b738fd60d0c0626b527393c

SHA512
30553ec480f07cba88f2332bd244bbf2873d02879ee682361e00570ea392e68300566d6d4b9e1b9b05daca2c0aa466f081485290766279cd1f1a2784fad8b5d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c52409e965e63b4e87d7e9cfc770f484

SHA1
014ea67beeceeadc6202d0532aef4c6497f3ad5e

SHA256
f4d3c6f4d857dab8887fcb0d2a1f5ff7bc58bf0219a793d9fa2802c2cdf78ccc

SHA512
c02960c14a7d1c550abbadaa02e350ddf4ad0e8d5c2463045d141e96fd6cf93e6aee9e28fd39507def1d08925d558a891635cdb6c21aa7ea55ef2b79c6488ee8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78be458c4a0ea9efa13e95a2060875b0

SHA1
c4ca4c0b9600c368eeb6db355b1951ceea642406

SHA256
f32d36317a9bf4f308a79f2fec71a89fc68dd7b955358b0ca29074ce79edfd69

SHA512
23a332dd3785c8ebe3de88381d6841ac08cbd0c55278ac92f00f4e980523620f4493d4b88b7f5e15afd7d71abcd160ef579151bd226015f61e09bbb7452460a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a20779e4048a5b4b17c87e7d78eb922

SHA1
810b4f09cb569798b42d81e7c48f5850775e74b2

SHA256
59aa7850826e78557bc449fd25f0792c17e0bf0f6e2630994e1dd1acb326bf32

SHA512
b30a13646fd9e7d0f46581360b7f01246442b8cf7cac8cb0edfe28e8524188f8abfeb47e51578853819ed98f291faefaa0f16d80f2c27a8036cbf6215a8b8017

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0823083e294ddd75b53241bad1e6ce2

SHA1
5f3baa44accb9aec4f6347d327ebb60c8ec790de

SHA256
ac6ad76630d4d943d4bd6498f97c3ae30176c93eb42c1551b010a049666b5a2b

SHA512
245fbda9a308c02658e9429592fbce5cc2c899fa21af10d189c447502e68af65bcc351a7b17b6b65337eec512bbdfc36dcd56191228d9c11aa8873c0a4c73208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dccddd6477bce06b4df2edefc2cb90ab

SHA1
18568a6c75a4874a904ade05a94564b2ce8cbee1

SHA256
1fd45b7eede98f3dee078230339318e001ada4d751a91eeaf4496e32c820693f

SHA512
96628b9e5979f2db4da7ab1965fa93011b1551bf225d22149cdd262adaa9d0a424b8191dd7b817db998443263a5458cb62a7f49920e7a73b1e8bedc11b223f60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f742213ce6c2757b717cc6e667764749

SHA1
1fcdd8ea37d7ded00ff15b9fdd46bd36c272de3d

SHA256
45fb2b8965854856860029202309e08621d9bb0a82f33cde516e29d61951e723

SHA512
a25e61fff093337e4367dd596770baea3a55b55ce611f620f3963653ff9b5ab3836c0717d101a88f7476bc0ddc76e07bba24cfac08425d53e5cfeeaf912e9866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6770.tmp

Filesize
81KB

MD5
9cddadee16434f6a972ef37da0c891b6

SHA1
5d3eb579ad53756f30771e7b6d8cf1f808016b1a

SHA256
045d08ee2ff52ff63c6c4a0a0c23c7043591e81066c5f34b10aefba05b1d01d0

SHA512
166849046810b9bff948644727ba7a80e4b88853da32cbb961659e7a3fea8baeb842a97ccd54a4bbd3024909186ca5e60dc72f1769fee87825f47b1a090b3f68

Download Submit