679dca70ed138ad507206865b88bab133bb767a1e08aa588c7ab3c703e158922

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

176429a2cd8e44939a95836be6c8c0d9.html
Size

36KB
MD5

176429a2cd8e44939a95836be6c8c0d9
SHA1

9a1948f20f9f127db5b3401d9077c068377ca46f
SHA256

679dca70ed138ad507206865b88bab133bb767a1e08aa588c7ab3c703e158922
SHA512

d978303fc3377543cb1df7b66d273f245ac3ed615fd6e3ce8b72382b728598b642bc944e4b451cd15fe58fa799f51aab941b99c0d9e38099f6412da20c92fb1e
SSDEEP

768:t+4DyHHFPkzluq1ijS0oA5kYTQmNnRHQ9lmXA:UHHCzluq1v/KkYEuRHQ9f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A388BC1-AA12-11EE-AA86-EE9A2FAC8CC3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000e0ec3a7e396ae4d46570d65c27436c49f1cd8513a56967c25b784080f9369267000000000e8000000002000020000000469fc927adeacb06e457a6c6b0f7ac61967c3a3d330e7aa3968bfa462d76c021900000008f5471af155006636ac5c84a630fb008b97d4bde65d9692d249d503961c06cfba072868e8d764b64be2c1c776e7cf27c48308b5c59d209af3e181fc2ff864587e01bbad969d54c04c92666819f20cfa6bb4c28dea1f89c4f0beb46fe80f7aa3c81b3df8d6b5af6d776b98c894d89e1f185500caa95b2f546d2bd38b5c5f5ef4c18d8e8e566c8b64340df83858cef0dee40000000c7135a76df2322db979c14cfa5af84a73f8bf6d61c4b905401c7ac5b1562e9bf1456789c566838020864882ca2c500e0ef3ee148a791955c684935984e28517d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000a549520f74e9ca3cd79ce0e85efe481e60784aa7920318d746724934c5adce3c000000000e80000000020000200000008f1d6442d20b501d5bc4b79fe1218dc61b720cc07dc1c983046c85c55f555325200000009e2331c0536c979782778f929bcf8db80ba1bfa53065d5cab47b3bf702625390400000006a35ffbb1cf0deba0e26d7be712cde4752fcadb0ed57318cfbdb49160df5c1a7c1f6fa376f584c938a5d3c926a9173b6b7d5fa94a04076c67576ea982ef07e94	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410432531"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07c42431f3eda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1872	iexplore.exe
1872	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2112	1872	iexplore.exe	28
PID 1872 wrote to memory of 2112	1872	iexplore.exe	28
PID 1872 wrote to memory of 2112	1872	iexplore.exe	28
PID 1872 wrote to memory of 2112	1872	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\176429a2cd8e44939a95836be6c8c0d9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1872 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
b0621ff3b7b25a8cf1c847a57ad76024

SHA1
fc1aed45e2770b1c3c1be461b038ca230ffb35e4

SHA256
8567b1fc92982e24dcc9f40414c1fc138b9d3737413dad73655dbc43f755c8bb

SHA512
9bf605249e9c602eadbef50302a0bf56b3407ea2a05d91aa17c02d4ef58e50943bb6307e9754c38261e99f3b49a50c91a2d408058864ad8c9a7a4423e0ce2c05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
652aa30333dd25d33b22841d472ec3bf

SHA1
2ff51c8c6403fadfd80e11495faea3f43c8d7b01

SHA256
c26e329a0568d8fb781079e2f9b3751ca293767bf28558b00171ea60b1b150e4

SHA512
70f052fe3d1516e1afaf0b88bf7877d0220561e5282fea305f2e5ae2c1000789479215350b422fb1f7e9a2eefc914d54b95bcfbebd311a7fc1932bb119f21628

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6913e148f5053456484aabd2bb5b40d6

SHA1
595794ef9b4c9c174afa07be9011470109155a00

SHA256
8b3861ab7fcc7239f6385783109f7aa8cf1e873ddb805c9a7b18d128d19f6f64

SHA512
1fa5772cfbbc6ba93fae382794047ca6bf90e0d43475fee6a9380f658dcf23ffc05bfd9329915aec69041683764d7a53a9a110169f93e7a9b6c9a7f889d987f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0df4e9083e39540c3f7fc05bc753fcec

SHA1
f8b3d652605784d1390a5c85aafa4f7df4bacd2e

SHA256
06ac6380bc28c41267aaac3405a15302f03999557fe084628735bd7e72ec6713

SHA512
9f012393c02c2a5b26cc1b22f941d7871ffaf08cc54cc3d8ba5cbcd443d98b85cf0105417c2cb31f4515aa63ca57f6e87fb00542f9fd51f334b75e4e83480ee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bbeee3b7e266033980ab03790166d6c

SHA1
0430abdf4eec15297c8df2c0eac7da9d16afe611

SHA256
a425634b01f0435ccd7c410749bf7593d0a7a702418be1f1b01b743685cd2dba

SHA512
34c331858129ebda7fc6221eda8e378103a3c78452db1d8f3f095da3231afe443e0be829e162e67857380240f7926c2a64c2bdf34637ed52f012ccf4e059fdbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8d22f70f2d230f05cb459d5cd3d52be

SHA1
5db28a8ce2a7d74e2fb6e747145ceca78b4a8bec

SHA256
f6779e3d1b3faf5031a4b9af97d40c371d1e2475b0b5e85b84dba49ae5c9685f

SHA512
0cabe4a9be17a38def8d5825175f0e3833ede2d3d68f8a9ba725036d91ef5d154392ad987f83022101fa0e31ff009234aaa76f0d5aa13666a7747e6b107d38a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adae7e530fe13dc660402200d53b7a46

SHA1
2e6dd1686e534d74fe87ffb91d88e9974700817f

SHA256
bedfaf98859388bb9dd1a990d1c399685c23b69ccdf0b5c3573144f45fc24e8d

SHA512
1ae5303c75f60995f1cedc7f900caec452c20eee44861b5a4a4ee0b23fd4589fcc57d4878d3f7611f3193a3c580f771eb2d9c535046347db8582f7900bef2946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
692bbf37ac552d143b50cf55c76d5637

SHA1
cc49cad0972e8a50a9fe48bafd08c185ecec53c3

SHA256
6bb7a83e9ee668d0700d253b805e4a4a23e39d0bdd0af7b5858dd381b9bccafb

SHA512
5dc2ec88adf950d1b46b43ebbb5603ed21f55254fc1c4c7f1361f68bfbe67413df2b2dac547b26f7788ff1a3f7ba6970138830fc6426047753c6df53572e45d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1ca33e05b85d8e1f7e739f17ec0b9e7

SHA1
e5b7de3f6d9a05bb2417c76ba57d1eb35066be99

SHA256
c266ca3b22620822a30a8ffb29214cf2833eb1ffb2289c88ea61c7ee74a94e5a

SHA512
abf70dc007539a32e30d2c6efb0876ff7b5c5d23e442a76f4a359aa93f86afcd02a0a97fc65133472b389c37ba607c9c73d23201b1d93fc9381616da2de1a7c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFLWQ602\cb=gapi[1].js

Filesize
133KB

MD5
288c5ba5b7001fe841c32f690f62cc93

SHA1
29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

SHA256
c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

SHA512
e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\f[1].txt

Filesize
34KB

MD5
177f413f34f6226df1a1d91d2958ea4a

SHA1
0f70736bd5035ce5f3ac9d3cfd65299cd92d35f9

SHA256
71c78f0184044c0b81f320c30cbc41136049f84b951901edf9c36ac9949a3d5d

SHA512
a2348d8193fc1a5fc76322956d9ed7925fa7af7e0aeb5c43a7151fc9974b3b5af7d815486551864b9404db36611433b70d4e7f3f5876420ffa7254840b4f050f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\platform_gapi.iframes.style.common[1].js

Filesize
56KB

MD5
f6140cf2e81a9d5b9bc96970fe1946f6

SHA1
e18cb20a08d0c13d44b72e36e9560aec2187abce

SHA256
68cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5

SHA512
1f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A64.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3CC7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit