dd9d8d67711e1ebd13eec728298166b05af29b1e3c98d03827a05585d3ccc54d

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

136c2faa0ddea0668af3aff24cb86494.html
Size

16KB
MD5

136c2faa0ddea0668af3aff24cb86494
SHA1

d85d98e08774efb74676b9fcfba09d35e64758ac
SHA256

dd9d8d67711e1ebd13eec728298166b05af29b1e3c98d03827a05585d3ccc54d
SHA512

98f837a1a66a129fb481b3bbfe02661cc7a1d25b43d3b7457d37de712ee0c36ba3d27a3489b8b242c64fd300ba63ec593d4306579bf08e731c85d70b6e53a591
SSDEEP

192:FGczcnoXG/7XnzyfsjL0uZ3xo60FHXpgqtsnvnXdxtjRt7c:ccgoX+73zssj/6FH5KPdxFRhc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A5B414C1-A8A6-11EE-94B6-42DF7B237CB2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410276304"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000f27ac271641910ebf1cbfa74362448b9ad6fcd2c907f865d4834b01d63c9affd000000000e8000000002000020000000e398b1803a9ff11b6abcd70dccbb6da5c095c471b1f39fd11aae582c0f2cef9e20000000380b9242e77ceda76c273fb8e3d1c1a4a8f1f2cee339d96f72af28d3158b0204400000007a826e9f085dc62f7da7f95af28f2e007728c3ed61d04ab07829835ca4e09e33dab5cef7d7755d26bdf04e7de9433dae2f29e67a625f3519519c072cde65ae9f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10be6181b33cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000007060f5745de92e5e19ee6da694ab64ef40ea632a173720e3943ef1d80bca1706000000000e800000000200002000000060d306b4c9dda6ef9080d6297c42be2bab009478c928bee9f3039fd6270c352990000000d88f93569dcd26a35e86f5e32a4c2040847b099e764a088edb59b45d14581e01c2a675279fec6c50ed55d0b669984ec481acfef6314b8da43c7b363212aa0c7ed1fbc84192e309f52c93081ec0b5b3525ef0e050305f3965ba3ae4e9ded5463cdd8a7463961f18a4d746b459778c22a98931d75c4f68e118e8000beb6c9cbc59d08cfe9f32fa4b6497e8ce0df045f2934000000056f2b49a2b64631313f3fb9b31a70c5f45e722da54f04ae0e52b2ced5c2761597a925d58e974462e0b062bdfb22f5687dc44b28df000bb1463b2d559c3a7b1a8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2052	iexplore.exe
2052	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2704	2052	iexplore.exe	14
PID 2052 wrote to memory of 2704	2052	iexplore.exe	14
PID 2052 wrote to memory of 2704	2052	iexplore.exe	14
PID 2052 wrote to memory of 2704	2052	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2704

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\136c2faa0ddea0668af3aff24cb86494.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e8d3b156339ca6e90d4d24a06478478

SHA1
e576a919d59590708bcc1e15b0feee1281bcd249

SHA256
0123af904b2e0fc32e44bf089dbad0653fbc4d2d9e4e43b7bb2cd2296e752dd1

SHA512
40c14ad225889ee3bd2b7ce6f68566ca57a946d84341ec402064e22ebe41c4e800740e1d30602bdccda3932c4467fc0ab62f1cf3b85628c273c59d01145841a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b65f386025c31778121615af997a0cdf

SHA1
e826326df30b01d1367ba41e5c6df40c509dcbdd

SHA256
db497ee8a7cd4fee0386e6c9d5aafb52c233a3a9badc0a4cb041ea438f57aef3

SHA512
141559b5f0a931e51b89dc08cfc0dbcb60ddafbe88b92b93c11be8dd902ba80f8d97a14cbc5965bfbe4edd72654be68acab0eea961d914748e5a285f113b0a97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97a57b00d5631686d503e232bb0a7680

SHA1
0aa9d1b1ceb18f6c8d4f3fe90ad7de5b429fa755

SHA256
7a50c7ea5fb5680b75e47c4121c487f556ff201b15f94f6fca8027efece8dcd3

SHA512
702f27b21edeaa9d2b37e995be136eac67de3551b10779d3498c93ae69c4dd68d724d9400cbabe46c9080d977e1a6a207062d11da3c9ab61c48540cc988294e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
958956b1b66780f5b0e41c03ae5c34c9

SHA1
e8b744eb5104d323263e80e368ef2b5637a5acf2

SHA256
bcef4e3668bece341f6be555c8838b5ba4fe17fee6e1f0d870cda9f9a16ce3af

SHA512
5d77473d06271dd8d0fe7944cd8f27bd8364c41cbae87beeeb90a7ba9ef4a45d314f4ffa5a5dd796d10f0156744f791a6545bbec356611a49fd79587116877ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e224afe18f393866bf6da020a81165d

SHA1
628b7fb479bd495788fc60a7ee6315a89ffb598f

SHA256
39703842b7f9bdd25c62d22130a065503510e5cd8c8bb656820168debeb3b7bf

SHA512
df8b5a3dc47aeb907dc0ef1894d4a6ced9a43fceb03a83beeae432e0a7915d854564848c0374980086ccc445381f92800bbd2df7347e0ff787f3e18422d81891

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f988c3a4b8fb1ba67059f7decaab9f3d

SHA1
505a3075a233a7e90848def92b71f6288aa8f0b0

SHA256
9aea3af355ccbdd1a88dcd638af8cf98c4ec2fc107b7423b4966ac081bf68226

SHA512
81f72c83a9882953f8de30c499aace0d38847ea4e5070ff6b16749808a17ec1e07715d6caeeca32b5d8c64fbcd17fda73558afd413f4cba26a00803d5e89b5c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d90807c3e019190e9edf372e07566e3

SHA1
7b3657722a26ea2d1dee969de5b9cc0d483c725e

SHA256
827a53c37a0d51dd64efa693f61ea4f24d4cbb69a488b51f56d43da25312ede2

SHA512
5773ba352e53748f0a8660e2404fd8b6e3cfae1de057504e44dadce01a26b2c9bda1d72310a575fb659a236f880280594f1b509b165f49644c81215a83a4e6ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc069f9fb668bfff786ef989ce456a5f

SHA1
617c3b73c7b22b1192ccf472a0722ce980b554e0

SHA256
6932857dcdba1dd094fdafd9ac486fbbbc13a23e2cdd1f9da4b405181709a1c8

SHA512
1bddfaa5412fb78d80d150306f3a10cd283497cad2ace9c50af87374a94a294d946c2a822bc5dfcefb696c5da3c02b26a651907fdfd47c09e890628755c0297c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a57aac8283736976f8893d72545e6259

SHA1
75cb6c7a71bf3b27ea146c5bcc4ab9d5e752b40c

SHA256
cbad9c90ba0ba1eabbfeb38aa97e3526a6dd74e633e97480cfc79c521e789930

SHA512
794128d0720299c810b52f1385fcaf30f61789ed2cf8585fb4c1fb33f3b698aad12b3ee2304921fe4fabb3ee06695c77565015b05985cace720796b217f5d924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2de4e76664d67b9d6f50204ae20b96c2

SHA1
07195f18f4356a5cef17064c63263b747c8afab5

SHA256
59ce30f5ea7453c4cc9adf6ac0a6bab656dcb7f94cb883557a284f664ef9c6d5

SHA512
63d713d16e54d9f5d27edd12bcadff13623c5235bbd72ab1bc0d766dbbaed9d5d0c521f4f84fc848a67690ee5e5a638913c0b98143344e0912f30e6a6fd1d478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3524d5eccad8bfc8b5e670a5dc173ef

SHA1
736f9b163bb3bad0d744cd0b4c47808df002e4ff

SHA256
5496c48d7f81f4467cd28858a936f6838f418d15df93657b11aa302ec4490d6a

SHA512
781f39a5d396962510ed2b2e2a55d226c65dd0c50e5a8dd739a02f4a4e2b73f8c4137fd35b02cf5c4c224e93bc87be20b204b52ca0eab0d59e168bf18b02dbcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9852c83f3233eb66ddb517356e6513cc

SHA1
64834e2da1262b970965a6b71cab594f4524e449

SHA256
a7c564faf009d62514043afcf520c776ec9ef3903f43f9460144f1c054602d8c

SHA512
c286a04fdf3249d5788efc70947338bb1f87a5138ed5aa7f78b18dbee8dc580e2ecf55295491a5d39fc3563b0584f6cab77029618dbd066bde35b56935ddacdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\05ZIV8W0\pagenavi-css[1].htm

Filesize
5B

MD5
fda44910deb1a460be4ac5d56d61d837

SHA1
f6d0c643351580307b2eaa6a7560e76965496bc7

SHA256
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

SHA512
57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab66C1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar678F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit