e717e14c7b2294b2ee649a2d5abb2c5ef42debbeccb01762558a37738a8a5482

Analysis

max time kernel
141s
max time network
157s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02cec5d4802618235222c3ea40a3fe0a.html
Size

21KB
MD5

02cec5d4802618235222c3ea40a3fe0a
SHA1

4deee53176f14c3fa1f41d7933253b95ff7c315c
SHA256

e717e14c7b2294b2ee649a2d5abb2c5ef42debbeccb01762558a37738a8a5482
SHA512

4c029829157b979912897618e5f142e14f08437a060b0910ec1ff705bff74866dfaf22b4b974bd054c47f9f21f65eb98b6b1283ea8e68dbcda43e91ce34357e4
SSDEEP

384:4+QfPFd9QZBC7mOdMQg+KfpC5IgSnbmFe7Acf66eF8E1jYfPd:Zcd9QZBC7mOdMQWpC5I9nC4a6fPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0029e79fb13ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF847161-A6A4-11EE-91D2-EEC5CD00071E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000006b4e14876dbcabc110c4c832c02e063cf758613dce3114ddd08f3b0d9d9cd540000000000e80000000020000200000002b48fb6690add81b71d52c47579718dbcced23b04cb53835925a557bc0db08b1200000001d0eed62817eb24e376b0244ec1c21193871eb778dd9dabd882fef2f92480bc4400000005105856f3bf1af8d9c3ef359f3eb2a8263b522e89f363ef9dc2fe3c3c314ea35c1a4eced5bb5e03a90e17cb58e01b15f786384caca2573ddb05ea3b4685b55f2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000004492bb0e21bb98dd21f5cc16e85e24403b3cc9c6eac362a1b2da4784f2fac2f000000000e800000000200002000000016916d56e2145508a8966d2b061d7d2b0bf8fd00fc078e39df5cb4ca9401499490000000aec1b20cd950bd6b35415073318179c486953874f33389f917d3ad73fc4fa477ed8d0def6df02c16cef357c8d96f42b2710d650bd947061e20a2c496618f50576c61c1ef3c842f44ee643ce8a369605c86ca6d437e5df332ca8cf673c7186cce19e0041389079e98a4e8a4bc6f9c55f43097640aa8107d12ca6f4c52aff080a849f60a207c8e3b5d2659ec36a410268b40000000d888905bc4eebc944be1749e114a9dff683a5aa79c509fc6e5d24479f214affaf2e2159836b5dd414a5acb67cec7cf1f2a199e87a76289ec6c8806f628a2f7de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410055556"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2160	2168	iexplore.exe	28
PID 2168 wrote to memory of 2160	2168	iexplore.exe	28
PID 2168 wrote to memory of 2160	2168	iexplore.exe	28
PID 2168 wrote to memory of 2160	2168	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\02cec5d4802618235222c3ea40a3fe0a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92500580d07b6314e7c025a507fea4f9

SHA1
2e1dae2f5264b3e25ab7a9edbbfec3fc7cb91b76

SHA256
839b75171cb805f728ef18cf3f5252d825394e78f64644ce633576e585bcf49f

SHA512
402363ee1c5210c84d9e0985b820e2c974a02a3cc17ce1c7bfe9d32b576eb648c59551c7130e03951f2aed7c38904795bcf5b2a9d603fac98c4fe7239c5e3dcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d9d6db3865fd13ba5dcfd6755161724

SHA1
54d538f530c9a685a86413d3e69504ce6e6613b1

SHA256
1d11cfa936ea43971e63a0950dd58b22b1a203897ba38b3c09ac67b68d96cff8

SHA512
95cb470d1dd1bfd501008a2487ee55762e9e72cad10fd3d00bc92de9f9994138478c4800dd09666cf76ede7207e8a6d4d51b355d5097bc412b892732acce748a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d881912312b2b1a28b53c17be8eee63

SHA1
be67efef999d603f4537fa27785a4fd7082d635c

SHA256
a27f11b3b26d4d860257de1544eb10581f396b1febd273fb576577d3be2c9e70

SHA512
b350953575fb23d1cb8a2b81b7a5dc558d94b7d932a199cbcd17ef3968423e441f34903834f1a5bd9a4cdefb237f49dce89a597110b4cd518cdba682114ec207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29c1f94de164252aedbe1d26a68adfa6

SHA1
1c0194a8189d7d0c67c92edcb5754b1fc4440854

SHA256
4cdab4bfe8dd474a42f27bce2ef12d3f0eeb6279bb69191fbd3726c94194571f

SHA512
d8409ea071c418d18a98afbf46e07212aa165a680e4ff661c97ab3f6215ed3479d7fdb499eb96a90d63b3a886093df89811e2735ea83b923c9aecbd33b4d8af6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2963f595c57f64cb29fff03849a31fb

SHA1
0cca4842a388191d62da3d0923d6f8770a882f76

SHA256
63eda7f89781ed1dddf9817ec22b5a5ddcdd29f4a7c6d627e93a0497eda02863

SHA512
f1506a3061602893a656755f01a986716903efc428de695c151d495f0b6c760dd49a204ec97a5a8d46d4054a23e439aaf5fe8d5fcc2c5fd9c776e7b046d363db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ad95722f5ff878e6f93a2332853c955

SHA1
ecdefde30db3bf778c48f3d6d5eb8ba152949138

SHA256
e5d3542c46c7752be4e1bdde3ca6112f2465d60a4bb8c98bcac9c0c35511db95

SHA512
564768159bc077a0bd1f380dc0101fce98f228399049a404906681bbc07861532abc6badeb55522be7b9d4d0cacd13a3eca79096d91fdb6cd2f419d9e06ce287

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7de7f5356b6c48e80425baa79a2a9f21

SHA1
902a57805d4c9258c63663780f320518f3b501a8

SHA256
7ff336a8e95094caae6815e191e2bb601fe9c78f15d4e3610299facfdecf1c02

SHA512
2cd149fa5cb9a92440dd9959febec2e638b57c3759dd8df443ba5ee381753c126cfd27731e6f4ab784cf20f785ad143e576ff200ef618751cba6e9426db56ecd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cae1e5596af77b2b7df2dbcd9ac83958

SHA1
fb06c1d78d8f89f0738ccdefe67a79d12e1d2553

SHA256
798915e9dd04e8290ce099adaea2ea94d3839f3effb98b123a51a69f0a406822

SHA512
6745ca2f1b709829902a42a493ee95aab789c1699ce25c325c970263bbb517fe26833a45973cea5b059a47cdf825be6a489b8bc2c05769fcd7872aa31b192d53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4091da0bd1d4e5163599c3033759097

SHA1
0ef4478474465fa41842731d04d5434edc79fe9a

SHA256
2be3e6881808b0f5af70a6a570bae745288ec13270563e1ed08a6c0b3fa2e353

SHA512
061ac0498ab5d8297dc6e7c652193df6a9f330e65470b2526afd449b188551c16062684820e5177d7df9bb0a0f4cda518d0f891c804de4a2b1caff7ff61ea598

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbe746a2564926753e8d2467d8b402d6

SHA1
3d2b4796b8a556b6a7036bcf98630e50d8f2b549

SHA256
18d59e31fb6193deb41274b1a856b89c2935c96c766ceeaba8eff477b2e6f424

SHA512
a8fec948546cf82634a448fd43ddab20ddab6548998b404b6019dd207441fc989f531e0b3d7508a59cbab120436d85ccd94c51c75b8e7d614b0581d3bc13b22b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f47e0116479016f2cd1fe2699ebdf0a

SHA1
0c1fae296329c2702d851811a1e945455fa05d6c

SHA256
c61c907c83663be7b5a2be829172c308e0730375c282890772431bd837fffc13

SHA512
a8abf3ef86684ed7e4a7362a9fcab0f6c53d0637fe4a55166d0a3df35be733a62a343f9f9267341024e367f5f93bc36e0930f425f98fe612972bd728aa0686e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46ba9331537a439ff5a7d9460dc51168

SHA1
990364a23ef86e8cc9965ca7b15dda15b5158994

SHA256
275a6540dfe18d76bdf9532964367fe933eef911e8b6d57feb81be6f192a5dbc

SHA512
675aae7b3558e237ecf01559b484259371057c85b47cd69f0d70b01cb78a8f0552af0238e247d716a56a5f97a9f8eea1c34869a4d31bdc2d0a5600f025902155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5990e67fe4c1682489ce9d2fa58342a

SHA1
ff4fa78e8efaebb9f4a290689073c83bc01bb912

SHA256
d4a1b1cfb6bfdbd8c9c2cb7902ea45f473e65d0d4f15864cde6ac9fde65059a4

SHA512
b5f8f3b75c5c5039caf009a9422e4ca687b919c0b5133efdfd6be099edf4f9e4a7f01b6f4776c2b23753e3fa56a073d39bac782d09e7cf90945b7fd06f6e16e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fa90a458e75ef873523e3bc931398a5

SHA1
d05560c745965715074c1cff9bf03c9548ce15ab

SHA256
70a5ea3b62b2f7c07181eb5431132a98296dfbf0ca848ae2b6dea9fa72a4d6c4

SHA512
b0dfb24d4430ec2a9ee4f01cf268f4dea987a9ce27276ce97b1e2bbecb3648f2fc0cb8ee04376963e82402880bbdef4a41391d0c46b6bef4c1e414c76447c6f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e21e6dd1948a3c1f0f33d7a3e5c9d67b

SHA1
17baf80de32d2eb8310d121bfbb4ea71c27bf575

SHA256
84ce7a41baed7b958db19bd7b491d90c338f41255793a5e8d6905c4b565140d4

SHA512
4251e64d9144164d5b64c07e37d97446c582ef2d8af1d6d78d34375e3ad984103332473efbf092995bea3d6dd65209881187158b163d614085e5824ca056e9f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55c26733f4d740f469399d42426a6aaa

SHA1
7f1df639fa286e0d0b8621d9aca96a193ed56fc9

SHA256
04966d7bfa87b142973f2e70a98fa033e8b4829253bb7aa9c3038f3627217ae8

SHA512
3101b3eb35e5594a1813e211b96beac7b285c9ca43d7e48cb98785a4f78b2e969cf7071fee8e834364ca9e764be54415804fe5392d49cea40891adebbd336987

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5276.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar76BC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit