e09058fc0225348aec2e925eab4bb44db69fd2a5c261b1a49ebe4db4987168de

Analysis

max time kernel
144s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fa367064bcebbb472d7160e87c83fae.html
Size

67KB
MD5

1fa367064bcebbb472d7160e87c83fae
SHA1

355a72d4cca6074cee93d2e8644655cdd48fa06e
SHA256

e09058fc0225348aec2e925eab4bb44db69fd2a5c261b1a49ebe4db4987168de
SHA512

ef45791eb788316ae0f894208a5024f14f32557a30586c376992576632907131860b749b8be4f038606cd7488f82a389bb5265e869744bababa84d929f1b2f65
SSDEEP

768:Sk0hqGbIiP//mdvsYSgLj/DVWmTMYq8Dfr7Vq3t40MSxjfLD+PHgkyMrj3DZ+/V8:Sd0Ik/6tnwOHh9AOucm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F42F771-AB37-11EE-995E-62DD1C0ECF51} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410558223"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000a2b3db3f278c3f1e48abf62f6d21ccd684268ef001a25bc65276617cd3e5a5b000000000e8000000002000020000000c34407c14cc3696666c46cdbdf5c39870cc136fff2af2e3414799809e705e0d2200000008a8aaeaec694e7e6f83f9019cd677e6ad9bdcc27c0c820387a2cec67ac36b6e0400000003f169f2ebed4ae96c733ee315e1009ba34ae7b280334e79a014f13e8e63e586b3aa839feae65c9d7dfd02bc966913b7ec47a55cc532fafaec34a6a5767b3c46c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c11501443fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000050c58575b3bb031c6829bd91b6e6a34346fbe48fdb16c160e540b318dc6070c9000000000e8000000002000020000000529ebae38648ea70373aafc7f5b32dbb1b875666123ad96c98ea143fbab5c12590000000dd2cd1c419ff74bdd3d914ec2e07d60b271fa2192e8a07c467abd7b52dd53d18cc555573321fcd4ce4edd5978826562bde5543bd6c560b65e587d866955d70e675e59508edf00558b1c0f5219c784f0d0770ad7ab96787ae4d0c8a263c2b0360610ef88b039aadf39f47a281e66b8e6afc9e634fbe77053322c03b0783e29f612febcabdfd8f0e651b6be8992325f06340000000460163763ce520d69b8ce3272b6eeeef6653206d609e76affd16acc4a60e7de22d2e804272a26e6907e3c4674c253662aa0a2f8064406195a2ff972e7340c2b8	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1180	iexplore.exe
1180	iexplore.exe
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2852	1180	iexplore.exe	28
PID 1180 wrote to memory of 2852	1180	iexplore.exe	28
PID 1180 wrote to memory of 2852	1180	iexplore.exe	28
PID 1180 wrote to memory of 2852	1180	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fa367064bcebbb472d7160e87c83fae.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FC6C5115380FAB833843A3B3E0EAFD26

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6feda3b48492c119ec5572478e28037

SHA1
60fe01202d1927a54ab46911411aa203b0521444

SHA256
9e39355c2834ef5902e1a41a6b4a0d39e096d9fee9bfbabf23600c7538609600

SHA512
af8e3cf021dfbe042cf1492dd8f2709b0cde16c86a611bf6bf7f045a3a08f628952ae4d8533f1cd7945c87d3e2904d64cd3354cb0c0c20dbcbbd12c372e2c9c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c016cf5087db61bfde81421aed8ba89

SHA1
71acaa66394ed55b283a87a45196319ed66cc27d

SHA256
840e861c36987f5203bef8133e1c7bfa5f3ce94be9657f381cfab13958449d97

SHA512
764ee79e23bf864f3f951d5820d0ac5bac555265d709323b4d50e618ed7c641d8307b217315e658730833b8e9d95685bfa71c1662f7a208d27da31babec9a42d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f78edfffb79026670a1961abde12ecef

SHA1
a44d7a9aca59cce3a43c043bc8cac36f138a5e17

SHA256
54921e24cec34d0818034cb73ec8453802726356bbfbc5fb16a4eb0c1235156d

SHA512
dccee464e884604a20a896f554b716beeb93172619140ffe58550a957ff724c1bd431f36b750cd2a990b05bdea6f78510f5cdb62923d336a5761d3b7dfcf8d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aea70ed4c5520339e2581f56385c32d4

SHA1
c0b068ffe1eea7ef71b58af0b8e3c1786bbbcd0e

SHA256
3b1bc061992a06f1d334e748489e43479a6783da11f86a7c9d62c121f24931c7

SHA512
07bdaa5a94656b81338d9bea853c17efcef0bd379cf015c10cdebcb47aa83a339913a3805af90f79dcf01aed7253f4fa58debfc0a3c9126f910a18c634304a26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
863db701c02790cf85d3b54b4261ff2d

SHA1
c64e4d469b574f605f2c5ee7f8b6f9919fd3e1cc

SHA256
4d757cd7c35b44a48c6efd733e41c2404ff566de621143374aeac94419b870bb

SHA512
4f727c469bbd479dc22dc809884620df3ba29565ab29fc63bd90170304a725e4aa641d145023d7a44b842e9eb04e7410ebd2cb9434657428a972786e5cee2f9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eec563a2af825e531c13a4ba9c19da1

SHA1
d50308276aed69adebbbe7f9d955989f20cc8f6d

SHA256
4c5515210a0d991c2951c96c76d7393b5a86659e97fbded9657322310c1d5ccd

SHA512
1d871301d75964d1f1d257b6bf6fefd44908578cbb5a6908c7c7743e601e826e92bdd33f2f96e136215bb1949beec76bc92d8fc8545ad0a8cad31968425d4513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a160ed4983dac4c312086a57bbd2912

SHA1
3cc6d32560dac87f8aac707a3613aa289ad0bd51

SHA256
75adfcec5539e21e05f02fab535f7fe059a65b699c10acf7dbe5c484519656e4

SHA512
f6846668f6a6dc448a0c8f130676f718b59c57d5de55ee9e17ed18f55ecabfbc973d04e4321208827e2d793de2eae884d604d950903ac766c631f37eb46657ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a77a40fa18394c1b197d23f0f2601ae1

SHA1
33ad6de8120b7aff25120d2db6e193ddcbc7d8ee

SHA256
7d3f6514b6d2d6f4de7351f5ce626d3fa12bb71e96505118f38ca0418c63359b

SHA512
7705a4993ac4a6657d6aedc27907ae4d44bc3d807d93909fe1bdbda9cfb4e22fb2e9cc141e3d010808eca8d7e9990ba6a6a5f8c1b9f06c307778c2e850464ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44106d3f355c2b5303ef9cfed5397d47

SHA1
67e4070b531d35468fa2ab4436b9869ecc1af5c3

SHA256
0821bc55084167afe5b9391173f62d5781e170a5fc164752051f98fb8c6647ca

SHA512
d2770fd834aff95b6108883f263d65fee3c8450c7980b898c450d301ec92dec95ad6578e322b83f7b601bbc6d571f2a92f27f373b9c055bf237f39296cb7ce15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FC6C5115380FAB833843A3B3E0EAFD26

Filesize
414B

MD5
9af53980653e3be64905ea57a9d5707c

SHA1
917c88938ca26ae752398c4d12c499eaed132f9e

SHA256
9bc05573ca86c085c7782f63d80ce6b90effd1c34fbf1927726eef8b4d10c74d

SHA512
ec64fad860aff64941153b2f2669dbedd1d709fa94a65f70059e239820b8a1268d26d9420574f1b34c0508c36cd57dfc664c8531482e4bb9125651e00389e5bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5EF5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5EF4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit