e0898ff6426eefa9ec4b3ce1fd9e47ecc2dacf6dbac270ea058dddc50e03de68

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

220bb6a3f7e64ea34bc8516ccc8c56d8.html
Size

56KB
MD5

220bb6a3f7e64ea34bc8516ccc8c56d8
SHA1

b502c5fd6c7dfd02eb201eae326434b9d16d16e4
SHA256

e0898ff6426eefa9ec4b3ce1fd9e47ecc2dacf6dbac270ea058dddc50e03de68
SHA512

6f42dedb12174be66a39c5999f704cdd0e3f96cfe0a2e25ba3c936e7b418f8751b8ea0de65e60200f19bc383b022bc843e018305411f7267df997dcdb4e7c882
SSDEEP

1536:gQZBCCOde0IxCsHFzUXwkkXks5dS2h0bR8lUi6iL30WRn0vXqtBACQiX/Wi4wUxp:gk2M0IxJzUXwkkXks5dS2h0bR8lUi6iE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000029f0b0c3ce7d553cbd5d85dc7871fdaea128465bc071f6966d067bab396f7f86000000000e800000000200002000000074680fb17b8fd7898087669c26087c0896f6379f7a6c00a158443b7337122c64900000009c4983b9797d10770179e99edf0bf78bd411685edc4574873a9d4893d3baa6fbcb51ac45ea5b81992606e2c14aca42750e9b5ffeaf77d161f9c14c39a576870f666cce954a6526a7567fdd5105f13a4e347d39653531be03ff5966f28f3899ba3fdb89bfd4cff0eb1c2d5f2806c6590c9f47fbd136cf7ecdff3d4c79f60fbc32124253b9efaeb80c880f080d72b91ec24000000049b1dc85a03334b15865a8fa217bf643cccc4478ceab8bd2f169cd4f06caf136199cccd4229889f4d8b5ad6808f4386b3bb7e876d018f39800a487b450dbab31	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA00D7F1-AB60-11EE-B578-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410576199"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000fccf76d5cea103617e64ad5be44d715681eb1a50272f7ede2a7c7b0a10ef98c5000000000e80000000020000200000004baf2e313e7552ce674169947ab2d13489d171a2a2ccfcc49da2a2d5e6eec8b020000000d06390082ea03b091ceff0d93ea98ee94e8318a294be0921629a3a49a051790f4000000076b95ac27af7f241f32643a64090fa8ef9bfd151d3437bbdcb51d9ca00c1b7578c5210b9a751dde0e8ff13aaf5cd2790a5a1979eceda29ab510cd7bb77937156	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20a3bedb6d3fda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2312	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2312	iexplore.exe
2312	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2144	2312	iexplore.exe	18
PID 2312 wrote to memory of 2144	2312	iexplore.exe	18
PID 2312 wrote to memory of 2144	2312	iexplore.exe	18
PID 2312 wrote to memory of 2144	2312	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\220bb6a3f7e64ea34bc8516ccc8c56d8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
047522018929f78f77719cd53677f9b9

SHA1
56c3e877dc8ac791ca60edf6c2524b21988c8ab4

SHA256
d53931004c32e7bb210f482b434e28ae4b9b9eac207c81344c76cdc176fa24a8

SHA512
3aa8126a7df78459025f4b2d3904ac846ba2a5c4796dddd478aa44ae354b94bd507f7e4c476c41294278df749356a07195a9cb8b12c4b12fe3df81be04eaa7ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2b66742f55ff42ebcbf401e658a7155

SHA1
a89191008ccba486cef46a9e95bc90454b104a1c

SHA256
834bd32c82bd91db7c20fff6ae82d505c5c256f497761b18a6e9cd1d2c875262

SHA512
ea472e2c0fcbd0ff70685c2b7e8d5548ac061368008c902275cb3d18430bca8b441a391a48dffacf156ca51da4f6ce9b7a4ad421bc27f4927bd6f1ee925565e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bebc6d2fbb927dbd22b7271cb19771f1

SHA1
9c6db87dbcfc39df5a54103ce81ab72250219170

SHA256
ae21e1417d86e2539f444368e1c8a5c7632788afe0fec8158dd624a3dd6032f5

SHA512
2ebefc8be02ee24afc5575f339ed3cec99a784bfc4aee1fd3d7c5ace85d0da9ab0ec03b89690941841574161fb72d5e18b55d1ea7fa8a7d8fe215c729dae3ea8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9a7f062b2e32c9ab9f34df96f276807

SHA1
031bdfdfde7069e85cbb52845f2857bb2558bee3

SHA256
93bf5f09b1243d3e48a70a696c037d158ddc6c72e44b705b3fcd11c1986e5a78

SHA512
90e764639410995fd7348679a3ee4e24b7681ac2623698b2d8cac952d7c2ebcef53086f7da5f4bc94c523cdc8ee458c70dd640c788d167805ad440cc475f2e72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
498ef9aadb6924faa7754c066146d132

SHA1
dd27b726bfe40e3b2f61f010409a8ab94e0c0d3c

SHA256
3746c53a4c46eed5065fec937491e555635f369ca071855eefb347f8bdfe638f

SHA512
c40625f6c3de19e5a938ba355316239b780ab68f95e530cabb7dd6ac33e0e525d3bc8a46a019bd66104fe0503cf35f10cf57b2759455bce26632a224d481b780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25adf56f87122879f0147fb87aa3c25d

SHA1
c8e46e65b04b11e36457229ec923612d8741fd63

SHA256
4451f3e28b6fc7ffb8ae8cbee38627c436524bd709032d0111c2145ffccd88a0

SHA512
81b0929d9ee83bebf287d7d1a9d98a229f0361e94b6ae2624b7d54b8baf548d7365634815d90ac7f70af1744972b00eea13dcda9b79f9436a769ce5b52960dda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e200a19a562ea2dadf585cb129ffec1

SHA1
43baf4b5fa323542c658bd48d55f208e59983b89

SHA256
65f31c679625eaf201126d88b71260cb737a00be52f1048d00c4ebce5917dd0f

SHA512
e6d570e831ff71a3fe1b29e92128e237bc2f34cdfb8dc9d89a9db35553f0b1a60fd0d7b5571ec9c9a79dddd40038cdaef87788240ae29d6362c0fcf5ddfe376c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b52aead9925daef6b4d54049078ea02

SHA1
c7434f11977aa6b64c5946c8cbab29bac9df68ab

SHA256
0b930a79a30295f8af588d2ad2533e57d9006022af8499ef6c0bb96ec6a1d3ea

SHA512
fdb97c9eaac08b2dc5f898ea2f5457d67563725dd19a5e3446ec4a4cd1441f8f02c033fb9601d52bd9160be7b138df1fa4936c6f971f9d55e45c3469f32bcb68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
120decd8bfcae8be84c65c7793f69d59

SHA1
fba48d5c5c15519de3d563b44cfd7e06d0ca09ea

SHA256
af8755240e1e23e49117e9841aa7863fa1438ddc3d7cbb6043fe20a3eb4b8907

SHA512
58b5f4a1065a423e87a6a3503d175a8b8191343c3f5c53194f88d23e14490857ae6ae1125eff800f2e3514007e50e9a7c17943d8a159e58fd0d381bee01aeb66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a3e8be36c14318dba29afba33110ee2

SHA1
68cce921a3a1bb2c42fb5c5e08db5ab6c02da850

SHA256
e6a893f99ac5dbf8bbf6d25f278a018ec6baf5e764cb708281a43437aec3b825

SHA512
bb22ca890db62a19564a5b9230c9a10f9d02311bd380dd94d05dfe165427e044deca6de189f0b1c9fbfd4f0767201113a924797201c99af3c46e927f4fed2b2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6d4c634be2fe29e255f6757a3f1bb85

SHA1
1c1fc780bfc718a8290f17feade51fcab4ce7fac

SHA256
95f020fb262c700304ecd8cd467e058cb544f73e4bf7aa79f3a4e56492cc5dfe

SHA512
13bffa6651d9cc6e96052ec07e3271725b8d7d085832b7da9cc1023e6e12a4289cc877f93f46e5887afff6ac620ceb27b19f6b46c7bc0c1d82bf6eab099375a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdeeee994088c0d3ad206466c04b1903

SHA1
d38c93d597b68fd1604b058261a40cf4ed7946d1

SHA256
d76493ed66204faf6c08d83e7c748634bb76fc3807c98fa9be039312402d4a02

SHA512
e8967078b0440eb3d1023b48a83f01555dadc479feac061fb62eb64112b602cc56cbc2ab63f12a04e76a0cfcd37bcc5ac1170aed880c1f571dfc831bf83e1492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7a7887deec787840a4b19926f5af98d

SHA1
71352eadfd9b06bbc4a6fde0f3e074d0b4d071bb

SHA256
ea3397f1fa3cc47a6ab346045f1f5883ac9ec66dfad0f20daa3987846e137ad2

SHA512
fe0d506fa002cd049dc585662ca17be56065b0a31f0a4ad7bb2ee53b8784eb6679901b06570b770999e18d66bdcf09d1ed8bd495cad3105655e2c8d0d6ec2ce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18080b75486795428dccedcb17395486

SHA1
3242e51c2d2f19f981cabc3e80cc63174f46217d

SHA256
9329cb5e1167ebd5895b059502d7a472ee585afc3b4ea66acd7a8af2fd819827

SHA512
93d8b395e636844a0b9ade9dba06ced6e5c64c33de0d0655eb62b4e90394e705860e9db3bfbb7000a72fb971c584c42c50d3556b2fbfd274288cffc0a4131e85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5488.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar54BA.tmp

Filesize
115KB

MD5
5b50c48ba77ac434153e8b319ea5302f

SHA1
fe06ce1f0fe8c97c33d6194713f5e4acbfe0638d

SHA256
c4dfaad594431631e8adfc0855b8f2d015349e86e25c2ae795037d84ed691479

SHA512
ba6e65e666b0ac129752d89d4d9e0be9948a56e9270e2ae29f3d459f11c301561b2d9eda8ccfbe7142b0ecc22e8a30d1347aa780976dd893d5b696948315022d

Download Submit