05411359bf4925e717385725a13a9876de93843303a7b10ea971f241b0a698e1

Analysis

max time kernel
140s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

081d0c93541ab3fe8a79d7fcb29e6699.html
Size

53KB
MD5

081d0c93541ab3fe8a79d7fcb29e6699
SHA1

773df1441ec60b778ece4949d971244fb25d1094
SHA256

05411359bf4925e717385725a13a9876de93843303a7b10ea971f241b0a698e1
SHA512

ed6ba514e798e7141475076da6c3a18be853a2663a46dea94302b300e7cdb7283813c07fc76653b620beb364351629a506aff4e841e4645bee5d70f22e18cf90
SSDEEP

1536:EI2VVo1ZLJjp1zHpHdt3f/OgcRPGs5AvnOHfBdu:EIka1ZLJjp1zHpHdt3HOgcRPYfO/Bdu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000005ae92979b36891f710b1fd85cc6e3ca100ad66424275799c77da4414fe7d2c16000000000e800000000200002000000051fc7de5fb976664b80179de1cd4fe9a6a061b8283b08926374c407e019fd4fe20000000332e1c76692a7ac1c0249ba8224dfefee0ffb580aa8d1769897254c7e1922e59400000000984ad8bd55d4afde8609eec9500ef2efbc907a0a1cabd6019bf4c35d17803d96bd7009ca04820775c2368f3b6ccc6672a5242decf5d2b5a0f80e2cfc60f73c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 505b01ba043bda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC4E7BC1-A6F7-11EE-87FB-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000b5d8094dd9ea32f1d1f0106d0a67121e63ca9d0f16d986ca98ea57ac48f77572000000000e8000000002000020000000ee84cd55139d5b434b0041a71d605cc3b0e250375bb712f1423e35815869901f900000000daddf455e016d50e4f7082703a6c81f19497a089aa9c30d0df8cf992d89c5eba49072336e153de7aa60b4ec57f7193a59c3ae62f5d5475ba0f0a66e655595c9c6f5f1454957081b810349a63108b3c18d0365f33ed1fd6c80d10074ba93689c47f93f7e59cb938c8ed7916027b6cfb9acd770b7cdccfb3b63c85fc565752d9fe79477f22b3d72e31560852641c2ae1f4000000077103c46af7171fd6f1aa9b8f4c48a178402388691330c9fbded0ec0e9b0e342199e5a2983b867de2cf3a0192acafcc605cd36158c129834f40e0ff38c27b24d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410091276"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 3044	2188	iexplore.exe	28
PID 2188 wrote to memory of 3044	2188	iexplore.exe	28
PID 2188 wrote to memory of 3044	2188	iexplore.exe	28
PID 2188 wrote to memory of 3044	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\081d0c93541ab3fe8a79d7fcb29e6699.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
80e50a45816a04fbecfd0a78f8e99780

SHA1
5fbf4a128231c351ed3b7011f82d8d5463a23953

SHA256
60831f67564e2b891abe268e7fd4063405688590259ae8b36b46c90ff4fd77b4

SHA512
f1581d20f93f346e3fd123c893e55e36c708a47c413f621ddaa52352cfe81d8d75b56adb5c4c5de209058930231234353d3270dfa84b17bf7228d00cc7ab3cda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74ee08114d20ec46a242776d484c2e7a

SHA1
f547efbe7675013c157e1dcac3e7f20381540cdd

SHA256
f86caba2a35a5504558bac813dc7099b71eb4d04226979360018680581075625

SHA512
981fd3a529fbdac696f3f3c5cdfaf1d5317bc1bc473147feb2dc3c10576277ec175fc9fa96896a5a4fc33e9ecab09f33d888cc71cc5d9c5bdf14ce7f542ea355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2398da912ecd1ac1c89756efc7dec3b3

SHA1
504024ade67217b2513a726979f2ba76f95beb7f

SHA256
3416d6ec9ed4987e36ef15d3a1004b1f247de319ea5702758d1fa11e3c6f7e7b

SHA512
7cdbca6cd74fa72cb2d540bae7da98f6fe3ecab58abcd23523be47bd0c76b8087e07514338f3662b33694a3856c7ffed919564b4fe9cbab87d267495e4f3f552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94b1a267bfa70ac134530acc1d2d9485

SHA1
59616d16e254c9f453ce5e35b16e49bbd629eb45

SHA256
843110a8c54fa86a7e23dfb68aa0541cb91063c92b95b5c3458fd93fac3cbef8

SHA512
e6cc18bcca2ca3a2be6a9c980f961289cf5d83c8fdf365b37fb0d11f91ca79f52fd5166eab72809939c28b72fb815bbd6b66f48b296fe6f57429ca72d90039b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
224a689f81d741f1dcf3bef5d2021d9d

SHA1
3ab10f2cd846a66fb53577b82e5fbadbcddaf7a6

SHA256
be5b826b7dd92f4ea2651f52a830cd58af2befd4f096f0d38ac55ac907a826f0

SHA512
8d4597e8baa99fc7e39465c127c1bef86afa12c2ea9266d2dbf621e3697db72cb252e4e2fd7168cb418f5b561d9f7a3036d861fc6be4b26782d5d8628043e42a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
451d53b1cbf8ab92fe888b604d974abd

SHA1
21d93d6b0c82dbdb7b30dc5fae51a2ca95842aa1

SHA256
42a4fe5e4f233c24dad9dde37fcafa2f23fa488f4e16203d72e90e3ac8485c3c

SHA512
005bf1ba4eb7b79c7c8f472a146b980dca57e7b561c8316aed7a6cf394584e2d0716356c9b83a8cded55fb8af2e6c85da89bea7343e6450dd050aa1419a14667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83e142056f3b375fbe4fafc58e08a612

SHA1
8acfa47dcd6e04f41af7705160ca91d23eae84c5

SHA256
d832ff15f4efe0f1b40517240c4d94f7ff8270820f70f73df213974dc431f3c1

SHA512
f5d0aa2a9617961fd0aa94e7ef383957535976ab55175896d0d8621b0da9870df99078bab95532cc370094b47d80420f24eaeb0f4efa0e8649eb9126c02f96d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8454c7b9c04dfdc143968621eeb2ed65

SHA1
2f8b0a407b91a20da0613784139a6675e2d5249a

SHA256
f6fc867eaba36ef7c141671670824eaaab6e95009d024de975cd7689c6911dc7

SHA512
4df519d63dac18dc7750306cd38e3993294f22408ade1dbb771a63d90401f9576716bc9c81a70b1bc27506f8540eabe064a44aa3553a16b7a7014e447b23220e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f36a0bc468ed8a80b309aba0546baf6a

SHA1
191e5ca3c6c2521ae2c03866193978b85a8deb12

SHA256
bf5a357b6092627eddda6990cd47d57e0c56275e0431dd48228afb65b0ddfd97

SHA512
a845e1f9afd1d9e2bd01f220f8f3306f9b9fcc7997f308beb398be1bb43e5c9e8f6d56bc584fc0abcdc34b904ba5ea7e69870a215ea6e538b2f7fb8388544d4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c471d7b38e77ba2e4c66e66a00aa6b9

SHA1
97aede5bbff004d5453777f41533ae759b53f8f3

SHA256
db10b2f5f346498f311895b019cd61b07f4c8e166070b67998c4a5b7a6e054b8

SHA512
4edd12bd043642b6bd991d62dad739e879b9344f3e331b514fe7c9dd1e6c2805138294c91a49cfe7a9bb7ce0ea72380d0b1c8e06d2648a9ab99a461efa3c0287

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
586afdfc6af806a36d3221f2d33a88d9

SHA1
e1759a21978f58769450ab440b371640c162f6af

SHA256
0cf93dffcc5bcb72cd475d57661d362fdc5ee4e8a6138d5e241725b26f074f3d

SHA512
0e751eff0c3e9d153950b1ba00e70dd9bcd6040cc898464d51412b6a424902397da316431db0bc231874fce0ed12fe6bbcae62ce7bb886feffd6a9cc06aab4dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a4dc82f4f7db6c9d98ae9f1dc07b9bc

SHA1
e6644104f3a2e5e08dc78869a4fff2e0b19c7f4a

SHA256
4d46cf26ada9f448554fa47f1218134db31eaee60589061cf3a5eb36075d0bf5

SHA512
4762d99dc00e51e7d2c68eae7428b4b8e9d655d5978aac747da09f49f7f3093e056ff9d569bd34c1a4be4d924d4b6338b20aa1d021e95da8ec806b9e9be5ecdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E05.tmp

Filesize
21KB

MD5
0307a7706d2f01d84da403b68c2addea

SHA1
a499eb5d3fa999b5bb07e45762827307ae03785f

SHA256
1f8913ae4145be5b0321c4b759c3f7a8e2d91b21bd3c62fbfda90d7ceb135b89

SHA512
2d74e0b4d8ff0d0eabb2f686323d8f6990a7af3a1996c9af954c0622c717eadd1df8da865414b54c3489d26704c396409be466eef4dfb4dc54cd708a68614cd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA19F.tmp

Filesize
11KB

MD5
288efbbf1dcbcee9ee954e6d8efe00f7

SHA1
eac3a6ea3b0bad57f23ec25f052d41496c8b37fa

SHA256
82baf24ae61dcab7181a7fdce5db3457568c689f217f4d7387fbd0d245e79d2b

SHA512
1f5d2d1fa5760f98a83a38c3906ef856b53b48b6092f3d75acd767ad8e35c7f5d81059a025ae86083259370f92886dd80ea008ee338a303d7e3b542bd35ef314

Download Submit