c4a0fd7dab5417631194dd42d5ff77675e8960150b646b057038186132865197

Analysis

max time kernel
127s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10e45c8d1cd27c5e7635b4fb6b999aae.html
Size

120KB
MD5

10e45c8d1cd27c5e7635b4fb6b999aae
SHA1

46dea1a41213fcb6a12ff0b379aaff4e0a2f0a6d
SHA256

c4a0fd7dab5417631194dd42d5ff77675e8960150b646b057038186132865197
SHA512

81ef6eddbeda36559d8827b9bd6b72ee0e19df4f9d39c6a0d3449076b78917dba8ee76bf41b154a19e8f42e6c4592be937bf7375ca8727b413984ce77e78d311
SSDEEP

768:cUjH/xCeVHDV1ZvQm3Gag9PGqkvj+iX+ySm1KZ3cegVPryMyNZU82Ml7LMZCL7LN:/Ljx6addP2pUkMmYBvy+NGGk3b

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{925A84E1-A789-11EE-9B21-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05cbc88963bda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000bd1697309880844df5a0c475e3ebb236725b3cca9502da0d09145cd15d53fe48000000000e80000000020000200000003fc513b412f186129b6f88af0a34f0660b001c5211dfd0e3ddf58baa70b9500490000000d4e3112efd820d1451dcd3d949707d99189f4838efea2054f7f19975220d83076eda697dd8e1df8b9f04c28b5d25685dc4c4c2e64ad1362c8b8bcab1e40ee669251983fcc2fbcc51fa530ee810fc3bc6c04664c350efdb065483abf7949b717105d1947b8086462e655e01c6a778fb4427cc3e643784cca14c90452652485d16a600bbe748384cbf93a2762716b8ac5b4000000016a00d6c2c9c84db904608de2d33b3568dbbd2d36e398f2a1a527bdb2ed3ee94ba6e13f4717095ac76ce46533004e1aae57d20fe4985aab35accc05d886c0058	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f1def4ccb69f4113d2c9d4450cfd20a37b6f90fe9fda349759deb13a3f2560d7000000000e800000000200002000000053bc3fff10b78fa0851f94ea8c9d1767a78d4be683d44a9e2031f89d2baf0d1e20000000ad280716012b916d62636b34884e34ba4ff2db9ea2f841c734a52112f019699d40000000983073c8a282579961db7f82dba7e7d8c74464f82fc8199bcfa69e97edeb4dba3a9e9a28ec1f9e38bab8460aad8be40207957d36d12de2ce626f49b3b6ed3814	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410153861"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1452	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1452	iexplore.exe
1452	iexplore.exe
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1988	1452	iexplore.exe	28
PID 1452 wrote to memory of 1988	1452	iexplore.exe	28
PID 1452 wrote to memory of 1988	1452	iexplore.exe	28
PID 1452 wrote to memory of 1988	1452	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10e45c8d1cd27c5e7635b4fb6b999aae.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1452 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dbb96b3f8dca71d7460dac7bad5eea2

SHA1
af0df45b1770383b6a5b044a92a59818afc6b72f

SHA256
cacf425ac36e8979c0f19fb04c81d1e8e4799876bdb79f4bdea4a80cc4de0827

SHA512
df7737ce6ea1321c6046ee13e24379d65672004606b1ad92bbc8c12a9a1e13ef6a1f2e8880fc1a7611de5eb213d93f260d2bdb31c86a0c29a2932c161cda57bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f9e86e239c307822f6cf73c0e9f3599

SHA1
4fccf0b54d8070d9b6cfaa22249dac2684f8f2c9

SHA256
83237f724d39c7a4e28e6f0efae2208ecabbe649f2b33497cb16a7824b9e421d

SHA512
8a7b89c8ce85f38a1d1e02fee9e07392dcc44737b7c7bfae9504253b4673ae801aa52d8db50e9607780c209143193386a65dc6c856198fac191c89b4fb9d0db5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c48f262f2d85adc69c8d2c8c2ec15af3

SHA1
323b06aec8c56e5a312e267f7c048dd4f73b4b3a

SHA256
7475186945ce7260841b3d6d40feac5d6232bdc01b1f923ebf7bbe8e14c5522a

SHA512
c2536bdd04caa8ddddbdf759a06f72b9456c29d8d2129513b800b9e61bedc62d7a5dde307a2e962fb44e11a3f84266eb89ed41fff2cee19ca4e0ffabb32f7701

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7db7272251b902ec2470d1a61085ccb

SHA1
6463a2741133446c508f5503f8b66254c838c55f

SHA256
7074427d8b59f0f0cbc5239c1bdb0e58cb056da716e10b8c456199c516e56db9

SHA512
f3eaf53d9de8e4843c473af7a2ecded251d0e3098c22d996aa535884da0b10d48d6ee25e0256636e0c3ad580a7ee6ced77831ba7de8300cad737ca54ce7a2b81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25a16ca39ebf03776af495c1cb6a9a9c

SHA1
38457edbeada6d116fc6b5f5b43b2f4e42377cd8

SHA256
fd5d2a283787ed7aadf9bf3f6de833da3f44cd3193e12447de99c4d9ce624dd1

SHA512
39dc6c7348586abc29af695ad87927f03e3fbaa23db33367bbe720a393bc424ca8f0c7dbaa8f0341dacbdab924430ed76d3c100781f54393df46b1a65a7ea5fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97cd5439a7ca4c685f7fe1a5fae06d33

SHA1
4bd2cf242d705e105c4fad71d578dfa812a51873

SHA256
d17386f0cd9d07ca744989fec5e43a72a66b2525d39e40a94d9ffd1741d6d9de

SHA512
84eea1523167dfe974c8122066d14c5cf6c14dcdcf193f5b54f9d1611e32a72b28f0107f7bf9698ebca31c256dbdb6325c61bf769ffd091779ee4de77e0eb6d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11d2fefb3a4bac862b6bf7089b948bf4

SHA1
02b7d6cdf4d8b350b356c8752b68dd9cbe5ecabe

SHA256
d38273cf85d016321c4800fab4d185fac44cfbf61359aaf9e6aab97ec87ad920

SHA512
804ee49aa148b1429dba3e97b34b27d16cefd871f8237bbf09ed351ef883ab5a4812f409894e03ea6cd13869a5941680bc7260af194c98d12fa73dfd531a06fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59e1528911b6240d2776d1aa2aa51b8c

SHA1
2f01cb66579f06cd793736a67bcb825d90b06267

SHA256
315da06fc5a5adca661ca825795e89d7dc4f5a6e40fd4ee3673535a41e3bed24

SHA512
c06e05ea335caaba0095ba41b0631b819b2533b7067c87de0bdd21351b06de7a1c4f97c2c1489706fa4be3c81e6298d2e6382b6180b0ec354bcfeb5dc53e93d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6cb4bb35f4d7d8eae7ac5e9123b6ad4

SHA1
b32eced8db9dbac02d6b2ca9ab23499d093c7a8f

SHA256
8bbbf957e8c87b1c43a92e5566833efcbb2444d079a931cba101ccc1e3856e0b

SHA512
7335684be480b8b5643e5902fac622d2e81cd2dbd3392fb15b6c952f601c268d79186603708d91456714ec09e4c0d47edbd8c90f5bbcbaee7b2ad7e59ab77f54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28c807080ad3a9d62e42234b6a85f6d4

SHA1
f9956b3b96e0b20fa09a66d3dfa16a724e12f478

SHA256
a2e105445faa783b31f5a44f1c3437b9f2fb495b2eee4f3fe4839cabc4964fe2

SHA512
e686027c690b1dc5428e4034eeb35d9891c280e6beba9e4d39ab8d465ab35a158bd1ae5e537c31c60111efd6a8cd7c1ab8a1ced06d00516db9627b7563130ff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb5e2aab4e0fb96edd0dd5a96a9c516e

SHA1
fcb4535e5a1a53f273292e3aaa9e4240a6ac3a01

SHA256
fd867a56f2562210b13b3dfaadd82f78d2670893b15aec33269d4896097c1091

SHA512
df307ef1535852a3d6bff981ddd18738b04d46018b7a22ce057d14185800958fed85176179a2f125f09203cc51d905d20276a663926ec2362b89b04152703cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d1a6891caf46607afa6adb72006552d

SHA1
79ba159b27c982e27b15c8974c5a587c8300fcab

SHA256
7f31b1a5e59a195fea3c757eb010c3488a1e52f354b8cbfa7f85049a23db652d

SHA512
77707b185125f1d973ddf9972d225d3e10d048fe736a975f121ab385ae0d4e853e55a94db8e7250d6ad54a746f19c195f83bbfd02b0ea1d0618938312b0f2e13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2d5679272ad003d07c1e389298f17c5

SHA1
fb372960117caff49fb2af5e1a8681904d3d1c68

SHA256
41cafb541a218f53120a281e280e3e7ea801fbe9f973d6c64d3993851193291b

SHA512
04477b642dae7348291acbf673168d965b692c961d04c6a3080d8d61ecdb5d2c4370914008ad4c8345169cfd20b764092d042614be9c881041d468b612b5852f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac0c410a04dd6c07f8486cbafa8d5e6f

SHA1
5cb355c9edbe11b7fa2ab21e74fc0ea3bff8c59f

SHA256
38c917fbf6add06489ac62c1a70cd93296b841a13c6858474d352e959a264d26

SHA512
09b0a4bf4d340c832d213f2eee1413ab24c562de0e7fe254de941bf8847342b498589afc69cadc6d058504c35af66d5fd518073bed5f9267bdffc7d7787f8f51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
261ab51bcd15d6ce0a41b2a8ad6054b2

SHA1
1ac01c8eaa7671ea734013a5f5abdbab907a4973

SHA256
7032daa306b70449b22699268f73620a7387d40cb874d08d9af3fcd1694137a0

SHA512
85ef834c3af74a019e73e1734258224d4bda2a78da828160f03019790ecb67cabcf2efb81a3edee5855f1fded53c6848aca9871785ab105e1ae48d7d832f90ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b336d28e334e2b92269a9211bea87bae

SHA1
7b10314dad614f44919d031db1bf1c3368ad75a8

SHA256
3a7da4434a40cb18e7ee747e51f4d850615bd04a51eb0c00ebb89264499c48eb

SHA512
ca4142447519a97f21aa09978f5f7b9d4380e3a468e6f353c9dd037db0535078f20c16d9e89df4c48de7e0fc946efbdf18bc3d7f4e001b6687513d2d72d8a554

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e57b1ed7f21fa594cbb444f04358e97

SHA1
a07264391658aa6be9d259b2ba5bd3cef0279367

SHA256
4bb49810ae9cbc4744775d06db667459761d49376a8d31e60565f0356faee88e

SHA512
92242b35274c0c71ce8a2ccc01db4b996fc3a09ff02930d88631337d234033c055ab526602c7436c5eb352ba4b441157019f9361e7af3a69d453e6e38bd944ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab769A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar769B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit