eb55bcf689f4f332bb5b3868584b73cb3e96a1d8a8e62c9e70338e9e1a3efdb2

Analysis

max time kernel
146s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01caa56b6c2db9f34577a2b9fb1d5087.html
Size

9KB
MD5

01caa56b6c2db9f34577a2b9fb1d5087
SHA1

5bbee1add5ebaa8c45ccd770b89e2f6e2d0886d0
SHA256

eb55bcf689f4f332bb5b3868584b73cb3e96a1d8a8e62c9e70338e9e1a3efdb2
SHA512

8576e5a3579b5f28b2691c7248af99ea63f98ef9e006bf666bc1161458a5146ca77a2263bcfe515ddc88eaa7faa75ae1058172b330108da1c175e1cb7dbb78f7
SSDEEP

96:ZNGBlAEwndjxwjqtCDwAnwOnbk5u0CQabE7mRLGPDiVekDFPqHOQGOdVmBYT2Xk:PGDyFtCDNnwYD2aAC4P0LDFP5OZuk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8037706b973ada01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000000670b0c3e1b9e7b5dfe4e4ebc54811503f9a5af4d62f9fefbb5230ee7e4e90e5000000000e800000000200002000000068147b9f0801455c58f73b360901899e984042d216589a856c68929f6c5ad76720000000842c33aeda7f0be72963a4a9d1d836f292023db79c3ebb7518370a4fa5a972064000000050fc8af9fa1e7950e2c5c8e48e404aba3cbefeab1eff21f66c33fe79fd9558dc0b16cd1b014e7d3c767a9deecf595e863c9152c5030c18ea8e5fad71e04d9a8d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A4BE561-A68A-11EE-9159-76B33C18F4CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410044291"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000ef9ef4be7f366119032095c9b3151efbb26b1da721236deedb7a485f23f76064000000000e8000000002000020000000b8d3cb14a88c953e0508c67d03efcf77881b5e6fd7fe33d81070d600a7c73cf1900000009fa9d45695884f03d812ebb0469b242c57b6fef1c73b0933028146ce91ff4952ff411f0e2348c44403ceecce05156eba0ec4e769715ad21c2c47c1718f1ebfc46f884db0642128e44c8fa48d3fa8b5e5615020cc33b945d35cda4a8d6bd793df2668090a9bca62eda32e4872d3b913eca8808d07697f1b02eb5c18b1db5cae68513055f09de518f05a43cd37c203650e40000000e17ef2397ff62e126107028c28c4cfb0b09a3d8096a66dcbeb5d1411c3622387f27a684067a26b9fc72108994b3be138d104bfe4e4cc24a24a708b81685ecde0	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2544	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2544	iexplore.exe
2544	iexplore.exe
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2432	2544	iexplore.exe	28
PID 2544 wrote to memory of 2432	2544	iexplore.exe	28
PID 2544 wrote to memory of 2432	2544	iexplore.exe	28
PID 2544 wrote to memory of 2432	2544	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\01caa56b6c2db9f34577a2b9fb1d5087.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2544 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3698208014e79c9d38e1f90a60d963d7

SHA1
1a51152a5c759030ef9fee761694eadf8b57dff4

SHA256
495cd6a0cc97b0ce8d47d9bee05116959147a2a5029dac52727b743eac72bcdf

SHA512
e87c5e19150fe47d07f47b550da6f67d5cdb3c3ee5d86561e524658a16b011d6ad60d6ac4a82575f44cbb8b7b9e6d942266c754d2053a5f29a27c18506572c14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1190666c287055336d5e787c34dc06b

SHA1
f273ebf240d42add18b44ae34035dffe2e4f59d2

SHA256
62f5a1bacabc2760d73956442b3028bc962ff4af9caf65396b1ddbe805ee6a07

SHA512
d43416d00c5d00579b8cae29a4190260021616abd88188c291b9d721bad8a712f3d3d03df517cb509319f474558c39a9cf07f98ece9cedc2f953ee3840d2a84e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e76b81b7ee9ccb9b938c958dc7870faf

SHA1
d601c8b5ded0a69529f66eadbedb2fd78c0d1a0a

SHA256
5b06247f4a4704c36ea81c01479c2f1ea689c705c970cbda6a99aae19429335a

SHA512
d1944195765dcb0be535b8a3c5e6176f01047b5f076adc565e6ba4b122591757f5f64a5dc5e9d357cd30f8f1baf5c34866462bb9494dbe7e72ddba188e970fbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41ad55c161cabc17dde22b931dac0ce2

SHA1
127690fb6f4ef236153983bd715f1b7432425e6a

SHA256
3de39dc758d7756019a61acadc34e2d09fcb77bc0634a1aa7b19a0df6c5e815f

SHA512
99b01664d22e2dd7a51985f92290c33fbb7b7363749387bf3de52d911282dcb9bf647df9efa3306be1366bb02f4f37921252eb015628de87c385b93ff4fd40f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fef200be0c9dfd0b2337c2e40bd05c57

SHA1
5a30cc19a26279bb3596b4b002ebfe675f235f42

SHA256
149bebb0b10879513f8b9d0f5a75d1f6a58a1a81c31d5ae7f428674be86d0c3b

SHA512
0ef91b968263a5908951239ebc8628236b82dce88e5f9b6d639de6cade736b127cd09b4730470d9c01b6c2e463dc03271cd2010cd954dbfc95db4cc0c64a7b8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1292463ab8b549822467131436d29087

SHA1
6a792d8dec12f6649b6da26b11a9fbdd2b8c937d

SHA256
c515c521efd8254662c4ed8383c29516eb840effdcc9164e393dbe4508114d76

SHA512
7dd27fc47594bddedbe3d6b08149109463e85afbe1376bbe744f865e663286bc7220f559a1b66274acea641da964f44c2586eb032819063330afde132b202149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1706355d8bba0425884aef0d0fb528f

SHA1
488b85609033010c806e25078e072ed37fc25321

SHA256
0668600f47a275be6276daa768220a6072f2a40606e59eea2e6a26748bb28899

SHA512
05b9119bb769fb5f844bce808054ba5c57dac3719ca7dc5f886380c7f00c2aa065d8b2a9c97a0cf50d9e8831b1357b866cb55256c1a327cbe9c202a9d9ab9085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5e83fc41e701bd7b6fdd3f5538e25f4

SHA1
c4d8003ff23973d4c99bb455d38d1d64581641c9

SHA256
0c9f9ed591ad1e5202c1a2ceb5ac5ef62e12efab360a6ee099b755de1625c319

SHA512
5f14f1a64117fe3cb61f03d708da807971774892de3e47f7eb70bc383d834ccdfe4fc6d287d9e3683dd1e5556ba068e6480898edc869ab6f4e05a84d2674dcb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
087b91eaef0c75d5a0d1493bc395bf92

SHA1
136f5a13f0692e9fd0b1e9abe9db2a9f06fbb7c8

SHA256
cf9751f6ed0a624c2ea6ae8751afc987f71382614dd634804e3c9b4d4ee44608

SHA512
233d49dc080b009b1afd1cada87068c82199f0e7d896473fd1aff3cf59408f41d8ae03a33edbe9caa73e4dede7ff853f687e2fe138177e320a88ab2e48e296ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11a53412c7d0572c8bfcad1109896f07

SHA1
0aea62767457ecac959d957ceaafaf54909ce8f4

SHA256
049b0bfb3d67546bc04c0f104512b4632e765d8e2395fda058ebeb5da9c53460

SHA512
b95015d5c2644f656bafb68ff6a09e63d33867af010bbe01fbbd869fbaa9f8a31dbeaab28a9181f8355c0ed66c6baedba8d023fc824ecfa79c5b057d0432226c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0393fa395949e7df6d1e0670179e884

SHA1
4d5344f0fde0ec009afb8a9e0cfbc5c339814b52

SHA256
c73b6834218a27dc2443d7a157bc7e7435da1cd9035fcafde6944b22eba68ca0

SHA512
3418596ed2f27c4bdbdfd179cc939b188d71eb6cd1b8e58d199ad18d0aea5f3efd9200e12fee8ed86cf08da878fbf74f35f89ba7197109afd9f87e282e513e01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89c92d8127e5aeadf26e0129f90ea78d

SHA1
5829180c2bbdd149b0ad361b6159ae6f3b9d6eba

SHA256
f42734e166a777d34decf41253f359c3e13aee698315fd6c3a659615c3b8ded5

SHA512
0e3fdb0339efba076162a28538b40714f166e15bedcc743602cec3b93d632660d5311afb8e93fd453c40fc358498ff79625a1bf13818991020e6a09eaa76940e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf57eaae51b8476f4c7fa896bcf7a729

SHA1
ed3ef184ebfae18800f8b68b8b4a6ec491c173b0

SHA256
374809e7c7fe364aa856c1d6af34b1f06f092ef7deb85cf6f89be9ddeb43d21c

SHA512
39ccd7804d48ffc8a6c2511a8e13ca21ef9e200581251bafc65a93848ff08247d04a0e41b2dd6f6b6c7584f4db4e82f07994d322696e53f930ba5015ec0a8696

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab512E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar516F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit