e04fd3d29c7a13c3179e1d2fba499057349226dc0638b0ef6255ca5c659820fe

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ad76a04f5af31fd0b18cea3428f070b.html
Size

68KB
MD5

1ad76a04f5af31fd0b18cea3428f070b
SHA1

33002139410d565fab9fe05710d48907c0340243
SHA256

e04fd3d29c7a13c3179e1d2fba499057349226dc0638b0ef6255ca5c659820fe
SHA512

3fac7d5704b59719dde40ff13b102966844eaf6f0d02db67fef264447e6d8d59ac06dea645a6b8e98616de10794babc3c69fb7ba4758a464d4c269277f2be058
SSDEEP

768:Sp0hqGbIiP//mdvsYSgLj/DVWmTMYq8Dfr7Vq3t40MSxjfLD+PHgkyMrj3DZ+/Vw:SWIk/TtnwOHIfucZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40379331513cda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000bc2b7076ee5896005a5d13a713647cde0011e4ba161c71cb7545ad0afd2a0264000000000e8000000002000020000000c61a6668a878dfadbe5f855dfcc8db0653a4cee4a47ae4ce149b066e82f07e27900000007fd68d6911de1448a13ec1f65c6996c11944facc275be536a9b6a7220fe0982336dadedd657457b71459b29722305ffdfeb17b9113da6746c86986c385ff2226e62c67ae8080ce2883db0cc7581e73a23b53505fd58e25a1564b698465a6f97864190946cee99e1850f864c7ea58433ac1cedd9f91bad1cdfb94560da092f645d2f087930981543c7829292eae31996a400000003d06d6f5d4f5acdf8ad40a97a095df15aee1895a125f93612c14e72c979a93b0238a50fed091c772365503c250ce2b29303ce1a3f07f88f1d6a82698df37e18c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410234060"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000005f8c2de0eadbab18196ae3f9962efafc3c9a55586921d1dcc92d8424f385c9e4000000000e8000000002000020000000aa2dc7f1e79f6cc4ad5fe4ae121e8f17315e0149d5c8115cb7203f994688c46b20000000bbb60f7bfebe060aaf305850d68cebeb2ba3a4ac19a38db4ca27e31ae66e734f40000000996f20e1bac7c4a23a1f0921d46538b014fe9b91e42baf18fe1a9aead85dbb7013c118d6f0156ef70dcbd6d9c4f64faa29f211af7de7d95f03a5445799046615	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4006D481-A844-11EE-B190-6E3D54FB2439} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2252	iexplore.exe
2252	iexplore.exe
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2220	2252	iexplore.exe	28
PID 2252 wrote to memory of 2220	2252	iexplore.exe	28
PID 2252 wrote to memory of 2220	2252	iexplore.exe	28
PID 2252 wrote to memory of 2220	2252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ad76a04f5af31fd0b18cea3428f070b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baba00a86c722a9716f08dfb67fa7d78

SHA1
fdf6b6dcd47912e9fea851911c2ce8cfb4d9e2a7

SHA256
b6745181ac4bddcc4f73a236e6b798c5140e775cf5fcd055b4428cdbdf55ed7d

SHA512
4dfa60ac155edf2682b9ce0ec17d28a0f075c64e27e8b52655f494f752484c997a47e59a68b8301a0e50a08ba072c30fffb444321c06c2a762f719fc151d18fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e33f8b3615f89943de50fe5f03e6c08

SHA1
e1bdec8c0e3fe63630b099b738a6bffc4eed4094

SHA256
7bc5ea32440e16ac57934431851ae4f467487770103181368ec1cf0391d620fa

SHA512
65a80b9cf98d32dd321044ee8b0cae22faa27a20e6b88068c6e45f678be944f2ebd961eb432725a67823e4944f427123b03a076a756457e0a5020505e6f76fb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b53fdd79b3822d8564e86862a3745817

SHA1
7767ed63ca3e68d47369bea18f88e466922f2c70

SHA256
264f17b519571d9f839ab981b7fb59b9a8e4bf0b0b45b526025545ae8776df05

SHA512
9e154c936a4094cacdee4e1b455fa9fd35b7dfe18bc7f4a2ffc78682f0aef0dc218853777388b68666388eca7d2fe6ea551cbfad3910496623b62203f8b033b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddf0d4569f3e7f2c0e51bee10c700c45

SHA1
42a7c8bac0eb8c448063b7e5afe97bcdcc1ec1e6

SHA256
506b39e23536dad71d2201e50ae21a1e682002ab49ebd0f63c759e83936b0dda

SHA512
d617a159cc2e3894957a7b6d2130a8333383b68dcfaf7ea9c23b8e971a4a3eff135bfb8ffb1b7af166269627cc7ec41a297398951cbe6e00efd7b01a76e0a129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44effc4ce1dcea15b547503f18675809

SHA1
a9d8a6d12477bdec528af9c860df4088216ff02b

SHA256
e6950e6e4414983cc86580ffbb7e86521c90e6ff9389377f9a85938e2068c52a

SHA512
5d3afa0d066d70341d422a78451ef8b3b1fc626c2769d059bf7c5864243014a39fcb144bcae649a6d7941686db8d712d9ad60e7fb057e17d3e4bdb188b9f08d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
014d8ecc0e4514013080c6504381f2db

SHA1
5f21e3d036ba94f7a0ab3b2452b9b460e0c648a7

SHA256
94faad14be3aa31dcbd02770f5bb26c4873d43aed65a800b43ac03d33d0d0867

SHA512
10f9c37f4113f89502c2b43c52466c9062a91b424ce0bc02d0fb30d9e13de007e43fa16b013004df81983a9fe870dda4e246eb56e80b6b8181451eb8ad22db95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a1c1110446d941d1ee402d45baf6e21

SHA1
ff7b1dfba0434852796faae9a0433a922ce9d0ff

SHA256
9fb6837750da1dea6b52c06032fec4e2a95eaf51c3dbf4337a1743a7057960fa

SHA512
1c8c94c4e5ea1a1b1963a0e98d79f5cb0d73206a3f778c0b9af58a007019b47ebd76c7e3dc88f4ef6da94b3ae9d0c8e085f9b7925e796e6f4f6d5f615fb95525

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdbbeef671418475e988b55d76fa1b58

SHA1
eae11af1232ac9f02e14dfc04a5e42ec4505160d

SHA256
0eef9aa4a52f7ad5f2b2e0836eb10590f0630a991947e4ff4673c4bc0621687a

SHA512
c5bc9ec9b91e390db1b8428a2dfabd4d9eb1101c3ae03f07ee47230416fcd278966ec1e28fc64229af83d924d419f99c975a8ea1baed9e5a463b46d12c531549

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fc70ee31eadea8b27390532e6b6f0fe

SHA1
3ec79363d9c6f28a49259c01abe4a8d429dadb26

SHA256
59b2feb0e3e32f942eb5a0f0df563558866f416f6d90a1fb2789225e7893e628

SHA512
17b1cbe01198ad72c537a888777a9f3d586783760608c7470dad095fc2237f0791063e99b99f973b3704b9a26664a103cb17806d057564676a986cc4eb0daa48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8fecca7030e5efb7e824b6c376569db

SHA1
ba303a8f720fa10ac618d01046be4e82c8384cbe

SHA256
7e960f74d03e0d582a9e34a947a12a697a94a0599245e3d3ed5e6e59261ac8eb

SHA512
6821a252aca94e42348c06bc3113f63f119faaee9af7b1d9d1b46f77af50ea67398d5590873bdda4bf717f52334438782f0010aed8892b150a586eb8654feed0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38b6034ae6a9bb9a13f93963b1173666

SHA1
c42d8f60bd1531a17efddb62f1382d7356c569d5

SHA256
e72b01ac3702a858dc11979df2c71aaec529e066a4621c1862c5779a5401b088

SHA512
0169de5b96a78af6c12067bcb75f050e06f251854f6dd707f2f94e84cbfb2d0511e217654531c30dd5d9668987d5239e12c1a79c58e26beddff4aef631b0f1f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c57075f424703ef27d22a2a1da7cdb0

SHA1
00eb65e2b9b38269a458b027f1b7300739ce7ee6

SHA256
0535edef6521161636ab834ab464fa14390c8485873b62de62f32cd1a8cea18d

SHA512
5f1c2aaa8cf6f461fe551ef40c780ea1874df18ee1c031aa130ba42f68560f12cd4f7a50cba5442780cf295daa9a49102fd19d3b53ee455fc581453680c9e1a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7569b67a5d4175e2945883a77163018

SHA1
a77385599893c0f47678764662001c1309d88dd8

SHA256
fadfc447f8524b3186c951ae0448f5096fc29fdc45cc8e6764576e12aae288c2

SHA512
a3da71c199af136a3bb44b8f26c2aecd9d8e41c2a3cdc4bb890ac59c2cc189fa5d811b7c48f473d0ba9db695d01a78c43d76c4d146be2492f6b121a5ba8c8483

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b50de40b9161a11aa84a2282ac6dcc2f

SHA1
e2590d7d081ec476d1c9431b2ae7a3196d2b8fa3

SHA256
fbf1328fb69e9f6cbe0dfe66c3587a18abed673fa15608bc76d16bffa7090875

SHA512
a563557e5d337e99fe94670a80107b91cbb487c35fa2f533ca078730cd472b0b9f0686bca631e3bd4fd1c5fb3a10a080a7f45ed20e44794a8326aa2b40e8a556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U1J1BPYJ\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E06.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E07.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit