e465933e01afa94c582101e49ae9155948b60474ec69f04a95de3892e3f3d521

Analysis

max time kernel
121s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0142c0fcb45aa3c96015ee0e81bed697.html
Size

53KB
MD5

0142c0fcb45aa3c96015ee0e81bed697
SHA1

2c05c156a5ec6427799f1c9b6d3eec3c15200310
SHA256

e465933e01afa94c582101e49ae9155948b60474ec69f04a95de3892e3f3d521
SHA512

51024eb5c7fceef1518461e88016001517f8c415838117d660ac97e8ca18970fe2c239615b36380b625daf52fb58d4d07d748a8740fa2c00b9ad1bf8b67aa5a6
SSDEEP

1536:CkgUiIakTqGivi+PyU2runlYI63Nj+q5VyvR0w2AzTICbbyol/t9M/dNwIUTDmDs:CkgUiIakTqGivi+PyU2runlYI63Nj+q+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000095d1f9395cb852ce9f3cfd649332fa2d81951e66770bf92e1eae0a5f1d6df720000000000e800000000200002000000053be3ee451f3f40452d53790688100be23f065ddfcfdd7be4ad9c1bc3479450d20000000a8996b55449c37317f162b15bdd1c391ee1471d76fbeaf48224a0ffea4e58c92400000000da16f0e271d96d6eaee00e028e106927549f83bea4a7da916a1e7a93107458fe7c2cdd419a1d02e826aca5ec416cac29ec15cfb12dd07d46bc5a06bf75a3038	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21BA0D51-A7F7-11EE-89A8-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410200912"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 606e2e19043cda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000118529ea8ea49a6b655b8dc84c75efe36f1e32a80d0ec07ac9f4a65af4a0a8d8000000000e800000000200002000000048d25ef072d7c0de12895fb759f24f80418573085472d187025e5a1be23e758a9000000026a9043bb09c7a6f8d321db7cb99997a2a590646b1a170536e06d01b5944cddb61ee73e378ab509192ca39b3b767edfaa234e91ecdf06da69faac46ef914946c1dfac7d2bdb6760fffc18ec22a98fa76871c366238e43e66eda096167bc21008f7f4cdeb9660ce6a9f53fe0277c1fc3f4696e831e243bb60c12a281c07ff1300aa47759924584495080d7decd327bdb5400000007467ee0140b81524bf3bcae419b920e3b5b6dd12c472e8148ca6119cc9f678817303f9a5edb280b2e88eee2a045300f207f78d5f2100d8fe616304bd72eb4d8b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1764	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1764	iexplore.exe
1764	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2216	1764	iexplore.exe	28
PID 1764 wrote to memory of 2216	1764	iexplore.exe	28
PID 1764 wrote to memory of 2216	1764	iexplore.exe	28
PID 1764 wrote to memory of 2216	1764	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0142c0fcb45aa3c96015ee0e81bed697.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1764 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95102329e093e0d3abcda7944e69f359

SHA1
36a4097c5e752afcf065912d4008699474ac49b0

SHA256
5af20e1fd1447fa4bba38cdda41a35a2d002b2f8f47e046af7165dab305983bd

SHA512
31163151f5dc32eb963fe7bf23874f1a187213261624b322c54356b17264192b47849f46e7b80a7da732b5bef3f2d8cc4b4ce88f53dd18a8eaee1169a09915e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
112e3accd2633594f0e7f2eda5df00c0

SHA1
d1ea43420ff180459d22167d7c9e23978101fd42

SHA256
8170a6bbc869fc42717a22b381ee9377aeb6ea3488c5b7a8ab5017c7b6846311

SHA512
f201f04e83c3d97737868c983168fe02f7c07263dbd87af8261ad69474d6b95788738a9a68bf5f9100a8ee091543981fe55b690435be5006035fd750e428ad65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
785e70a62d346613a6d8726953a613b2

SHA1
c88078de77e3228ff1b583825b78b071a184fd97

SHA256
74264e40a8d6b83ad4cf7a31953d6511325bfacd1739e3aaa0e791bcffb6a270

SHA512
11ed7d57985e579401d28d6836b24cf405c3e056ec59b1b7ab678bcd02754ab35c0b31fe658d32687472f360968f9f6e8a9b915a53134f26a5cd14fb3757b458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15c079ee24d5ceb1434cdc8f485bcdad

SHA1
7ffb38d2400590e7c4755252a774b9ccdcd8e702

SHA256
a72d7b851b7e1cc994cb9d204bf079e5cd9529cd7e1e34520cd05d7769eb87ef

SHA512
15ab59d5f7d7d519163602c765fcb4b3363eddab3a848c4b5527d548d501cbfa4f0e0d4ce4d81c04444d6f4691d854386b3a015dde97b348e8c33cb16d840b6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8f275cd8a7f0c3f6f174282e792ac84

SHA1
8a56b93df51a945f16e1ff2f212aecf4e14cf500

SHA256
70b5a4ad5bfeebdc730b5b89cf8e37a48e183ab2a2602b1619b6ccf208c9225d

SHA512
d69e3966590f556cdac4e39bc52eb03480f6eae96f7f7d248de260357e66f6ffddc419140f4a8478e9f4f2ce1c51cbcf990133db51475a64224740c7e4e2bad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17297ab7926dbf0aaa0da27085d73941

SHA1
34f1770601c602eeca65c884ebc23ec029a17e2a

SHA256
b85b8f57caa70481d6a9b569462a8562703f6ff2c81616b598d2c8f685197027

SHA512
6e45038a99c50b3dcc5a693d82fab8e978645db9d128fdd1332062f9926b5fe9ca02917f4ad2cea82ea972a174f472eb476c2d84de10e37d6e1c78c86fc484e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fff4a4651eb094cf80b5c98bf13935da

SHA1
b61d971a85b1af93f5789ea9825f49a8cb036c6b

SHA256
2a821e149a7fbc810cdca6cf3b9f83149f966005062b4e6e3a0206e3db07d3af

SHA512
6d26f312cf07a3ad5881fa960ea53a864e0eabd4b93ac4a2e3cb40d57b82f3293f1007fc233ab1829cc75a5e49814747852a50cf1dd2b8addf072cab8f6d82ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9112ea9126eba9dd35132c96301cc28

SHA1
da5f733a32b49684483c522d30a0f3cb8d354d13

SHA256
6bfb9789b3eb46537b61ca5e26d2ccc5b7294af0cfb449b1873f003c431f9cca

SHA512
6ada318a1c12394c31d217a75c47514ddb266204ebcd4d6fddd939d9b5c7402a7c2be18faaebd3b4f531639c154dfb579d8d3277e88939812fd3f183f9b58cf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d05aa45fdc406f3bc85461434aa0b316

SHA1
186c4f3393afdb4d6d2e41372b3adca17186d34b

SHA256
881f9e06c94e783270972f9a72d0b6bb82f40cbf80072a92578daa6bab2d9115

SHA512
e046cd496e32b509c9c8b4f9e0dd99306dd572c304abbc3c9dd5bc4e2569f953a34470d7e3ceded402a89cf18d9b4c67651cf9bf6708dc797facb7080386f4ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adb4293f7f1778b19d2b91ddc5c36aed

SHA1
911e2a5ec6c0a8df458c2a8d7229f97ff5193e05

SHA256
69d1c249157981fd112a112c77201338a5398e35368fb65eab916c5a0ca9fd10

SHA512
dcc8e5dffa04ff1fa1619ac72be14597282684cb139cfeaaf2076f75f021bffce8a4dc59ef09bc1512a5d1661257e728b91139f371734ecffb4a4b7a59d093f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dffd3f989f227dec50963cf8125faa9

SHA1
74e695ad1c0892d256da31f8649703a7843aa0ea

SHA256
68ba0d98488834a657d412926378a6685dda962e9e0a05e5ea7dc7a4abbcdbc8

SHA512
4dce5e301ece448e9408fac25809ef9e99ace697e68b39dc7c521500397760b3f8684fa81eefecfe225bbe9addd31d8fbe22348150b2d5d0998a26e9d72dfd85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dce0a8b97000c354e5c3ade67ec8ad0a

SHA1
9f0770cac1136301e2a8f85b611fb32e1ec884a9

SHA256
e68ad2064f68f56ae8dd0a34419037bb655c85579820f574fb9a1c663dc1bf6c

SHA512
ea87729d8491d6f4e2b8cb494cf8111a13d2d48e06f5205a079b33d841af26df75ffa4c47388ab33a8b8a4367603d086e1f83757a0da6c264567cd95c6103345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bb882f09fd34550be357d4dbcb1abd7

SHA1
219d0708515bd882b873c436cdc4d3c630e18145

SHA256
c0e15326098308d58e3ad9f728f04f84db3d07c9ac7cdb22b004dddf861b31bf

SHA512
6a5afa495cebd6416f16031873044d8d394e1c9a0c45cd61a6b1d1ebbe8de219857edf4df371f0cd6e239b2fd5cc54b5fc52b9d7750dcb809d7a3247fb86b3b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61e5d355094927f0764006ede34206e3

SHA1
144bbb10ac548a8173568056db5bab958124b8e7

SHA256
bb362bacc3212b02d441b620d0d730d0746a609c9b5ac767c68bf532c83d2c2d

SHA512
ddf909f1113a633d64b8de400f2e9296b09c342edccabfdb30473ac3416066e3c1f464ffde786fd33a61ef706ba242794d764f715ec130d9f33f5ac9763b4933

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U1J1BPYJ\script[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab41D2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4CDE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit