e26c7f8932e0abfb1fe928fef844c4bca01fe9cb9a1290bfc379b359df8910f4

Analysis

max time kernel
142s
max time network
176s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0f7d7dea51e1e2fa7140bfa8030e84d1.html
Size

28KB
MD5

0f7d7dea51e1e2fa7140bfa8030e84d1
SHA1

c144c6bccd0ecbac28f5b92252a9b298f20ed88a
SHA256

e26c7f8932e0abfb1fe928fef844c4bca01fe9cb9a1290bfc379b359df8910f4
SHA512

197c6d65698a20862c1a5320b50f47b5be8bc57488a710938cb227220a4faf24227b6a84c6de2b79a34c6764dab35bd5e6fc941140a626960dd8984b96916a62
SSDEEP

384:/7FXocbxnT0EipB0ws4zNcG3bWl9HTrakcM9Lz9jsMLodllR+L1DR98fQv1uRd:/7lT0EipB5seccbsHnaQ1JLozs0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000075caa09281697b553c2e7d762c10808527f1a1c938b216df7242a3d43cad5e9c000000000e80000000020000200000007a9ed97d547ee47ac90d08c8b4f2ceed03cc4b0a2a3a4f9694966d646604c39590000000218362d1745ca485375c0c3cb24ab8baebbe43fecee6998555131e535d96b52f747fe268808ca30ff9205b05e8eb19411908a881ecfff04e641aaee412488cc56f6dab0d6b02caf5f3dafe3647f6bcc3fc80b1d3eefe6340cf673cd0078d6d1f1df4259e9897e47e22b58ecf7070a0ca2de7639b88f7c201579e8c504e93b233e2c764aabb0752a958812699c99411114000000024ef29550c1766b4441275a72ceac8b7b2e7967cc26a8cd0bb2df60e078e1865ffdb1a887acce21cf84625d0bfd20e0d70d96cadb0b69a98c2a52c036bf9d106	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000de68142f5e6c64402e78fc99d962197096074989cf975b8594c35dedb2ccb8b5000000000e80000000020000200000005f71fb4b0c83e2dd675e8de827aa4568de906a3472215e4da12677f4ca43c93e2000000043586da03dc33f26c2c94fc99d9df8736119876c40ecd8064ac7eeedcf4d07264000000096626794f524b61a5b8086c969aa243891818b2ee13becc60f018a0f999dbe9124d0540dda2bc341a86fd43af45e29a0343993f01bc25fb841a8645314af9c03	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 706bf4507c3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410142654"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7830F961-A76F-11EE-9695-6A53A263E8F2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3068	iexplore.exe
3068	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2712	3068	iexplore.exe	28
PID 3068 wrote to memory of 2712	3068	iexplore.exe	28
PID 3068 wrote to memory of 2712	3068	iexplore.exe	28
PID 3068 wrote to memory of 2712	3068	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f7d7dea51e1e2fa7140bfa8030e84d1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
5684d17c19c43c9f1cc2a8d6f645e060

SHA1
42545fb9d911875f3f55f23b03a7cdeea158cff1

SHA256
69d08ba46c1be6a15425950f473f64451adbe8c8b395adedcb49ec87a556ecb0

SHA512
5b495352902f0137607a92326f51197363af5b53c268cef344ac8d16f4abff3263b7f1ff2cae88a0dbe62fbed9b2c54d6eacfda504d79f11ad930d1adab86f0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb420b200f00069063ed33ae7e908aeb

SHA1
b026cc5f4451a428b2efd2d99a96ba818deb9bae

SHA256
b83ae5acdab0c95acb4b2fe8db8b14bcf19caf76584a70ef20b7a5acf2e60f6d

SHA512
030c2a7654716abf6dbec500f2b0bf568d4b701bbc3ed2bf92880fd5e2e057e8b861ce9e0eef52a0380e2dc88c93111ff036f927a64efd60deca96d7b6300e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0663e29b02fef849d642b42420fe4599

SHA1
ea8a293b55147ed0d5b48dec89330437cd6fd73f

SHA256
b8de1391a2cdddd4857cf193f43f57d333fffe5f09e32dad5dff3f5a0dac7cfc

SHA512
779b3999a242f22e6e7dd78d1906562febab3b7de960b4c784137a05ad3ace8e38252c86aba261d57a1566929b80b37a85e49bd0bc0f4ae588b205e30ef3e46f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e421b9f29e71e6489b73e40a8aa0cb50

SHA1
ea0d86e8ef943c147f5ac3bed33d36931b15f8f8

SHA256
829d3bfe38ff194b1bcad3295f54cacfaed0ab7105394d6d908dfe6e44297842

SHA512
e8208cc4bcfe8396200cc9ad8d5b02d74bb1f3a687ba075a75a14714905c8285fe32866d80755be2b6a660131b7cb29841f15cc96edc9c3b75e5446294185a5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02ba4105ce9864158f59c58191c3eedc

SHA1
f7e4fc8c9ce043d47545fdffb16d880508572de9

SHA256
203d5b0f79f14997b5cdd6dc6bc65632113757827d2dcb7e71e6158aabd0959f

SHA512
dd3ba8e08499f36cbdd15ab65c19edfa4613bc843a042291392447a6724041bcc9a709daa53ccc83ccdfa2bb8828adf90b7c333d3007523844a03a7d97cf1fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1687221b486f885e0378d6c79947d3d

SHA1
58291c64ce0828b60e4be43e6b398e676d961b40

SHA256
d0d7ffb0ca5149fe4de77d41c1af881c813d357a1a13c6bcf3c03efc53ad5d29

SHA512
e6e2f40daf8671be9e1f3f7a3391e2348f807479187dfcea5642e19f7f58a9d30d591aaf90670288962cff4b8aa2409ade3f7b89b2f48e8d72300b76b605f234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f1aed6299420b2ae3345ba504fb1935

SHA1
2bd313a4d3a3647d433f707bcdfda0ec1a1661da

SHA256
1a16b3105c3ca3046be67f907b381819278aac774036bc5e775f1abde6da2d03

SHA512
74c664b3440fe2344a8358bc3ae4d29bdb1151eec749fb06fea2b3025165f6ab9dfbba0b64a00f907c3c5550e73ceded84b65eb1f4347bee7fc82401816f5ad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48bab0532d5f53471ba02b75a9b98490

SHA1
5a67cf44c031d50c9ae76ef2d1d6364a7e9d0915

SHA256
7dca86eb52a47ef38de7c1926811915fecd87e48f8645e9f23d0938fafcf4274

SHA512
70f1a0b994cf13b94f1846e79269e133fe279548d039514314f01a4a97ab22299a55805d15896a93fa0388e0b10b9dfa3bf60ee68f3ca3e4b812753659e9f49a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2d10e84045ed1446648fb4e227840c1

SHA1
0ce4fb4b90ade4525c57322c3068258b88f98bdc

SHA256
b6a79ba866576e590bd97e18061df1ce3c89052a69333b593256d515650980b7

SHA512
e25f275da82974dfd49089e5c79fc7258b6adcddd7bb4e215211999827ee2260eb2918855da3e7a7141079d1af0f43f6b3dd18648267e87be1cfefd196388820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61284ea6e4333d0ba6afe098a9489e63

SHA1
c7221373ffcb0563f3d88d40f5d6feeb3c68d95e

SHA256
ed29beadb35c94c1a903e09c6657c11bc1e52b66012f532dbba38215c25409f3

SHA512
3c68de2c16041067773de1914bcaa1dc789d5d13d1e6fdc56f85834d1805b40d592dee116db7ba002e73e13c74f16f8ce867bf71388b2dc950eb43b012418aa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\cb=gapi[1].js

Filesize
8KB

MD5
757374fdd25a2488ec4d8a50b4d35a84

SHA1
7fad24da711fd52e8e6247aab341979405a0c0f5

SHA256
7ac8cddb88b43fb749c39847498caa6baff164788c2efb38ecae8e816b14ba02

SHA512
adb0376544997ea795a848628ff43e92b49de698874a20f206b2874a7a5056cf3fa9cad6a585743d8f0362de3bed49fed384cf1971fc06bb16fb601cd0240e17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\plusone[1].js

Filesize
44KB

MD5
91ba1b075e91599be69e8561f663f8ce

SHA1
2ea19e84da896ac1f1bf89eb921fa2b5c9d3333c

SHA256
3dde7889572a5d5bd56b85f288e517850cdaf4f6cf1fad85480401c927ba014f

SHA512
c80d96f996d6f319829f9afa4bdb3624c085f5d0e0db503e396ae710fcbbb17d24aaf7126c8ac5cfe04b41844cbe544a2f458f8e7138c37325aa48246aeba4ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE276.tmp

Filesize
37KB

MD5
b985ca2842639dcd0cdf04c97cca0ea5

SHA1
2031d4fcd56a97a8335166f761d00b61b2b97c55

SHA256
4b1a8063a6b3ec42c52d2f544c6af84bc0a3024c764552e9d27aeaa99a26b165

SHA512
aa3689c8b2746bba5796af547dcf5c7b074e4a6f337dd4de91646f47d8bce6351077cd46b61355b2ec5ca24ca40b591055ce7d663e2a3ee899b75e269be575f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE277.tmp

Filesize
69KB

MD5
7c4eac9c5d9d87dced77a9a9c505e538

SHA1
c1f926498d3f43eae0195cba059d1a08188d754a

SHA256
3c16b2e3091295faa9f98776ae409f8b618860d2687e7151c1445cc2d8429248

SHA512
7959877cf1a4a1e40542a5605c8ccc5f91aa8f1787c68f00351b1dbfaa149258957490981c043344bfc3f9ff6b8aa4f8b706391deed6afeee905bb4e50fccf3c

Download Submit