e832f9b07f767e7582579f560762c3ac821a0beedad39ba0baa5e1615a06ab8d

Analysis

max time kernel
196s
max time network
234s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

24d964614e78a5e79de59d08aca009cf.html
Size

71KB
MD5

24d964614e78a5e79de59d08aca009cf
SHA1

a3ab7decbebaf9ca4ee906aef816ccd53059b98b
SHA256

e832f9b07f767e7582579f560762c3ac821a0beedad39ba0baa5e1615a06ab8d
SHA512

af5a88b3578bd0931e4d9fcc03cae083ed3b8300a15164a09f4e1a786f4676fc57135c944e386299c778df9f3cf7d0138b7f065a0505b878c678f1724ba38543
SSDEEP

768:S70hqGbIiP//mdvsYSgLj/DVWmTMYq8Dfr7Vq3t40MSxjfLD+PHgkyMrj3DZ+/Vb:SlbIk/itnwOH6j0ucT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410315275"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{66F1CC40-A901-11EE-A03E-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2600	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2600	iexplore.exe
2600	iexplore.exe
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 3000	2600	iexplore.exe	30
PID 2600 wrote to memory of 3000	2600	iexplore.exe	30
PID 2600 wrote to memory of 3000	2600	iexplore.exe	30
PID 2600 wrote to memory of 3000	2600	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24d964614e78a5e79de59d08aca009cf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07f29aa298194fdea6ff5143ec71b470

SHA1
f98e4ad979eb674b2d5e84574a4ae35dfd1ae782

SHA256
5ced8d8fcfaef8dbaf422c878625e97b64e9b1eef1996616808432c95628c299

SHA512
b766ae8bc0210068bbeb144b350408897d42ab4a2ec7f5f6f4583dfcf95aeaf626c0d8ccd70029461c035637e3b7b1034b434d2a404d6904c7dcddbaa1f4f9de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a72189547cc58a3d58ec4eb5bb32def

SHA1
8378dd67b27d18b7c3a1d60373355fb133defe39

SHA256
003fefa6efdc0363566724dd0452389d954d339e74573893d33ef0adabab61c5

SHA512
b22e50190e01e441981435608b5728168363e4d4f5bb5481e4f186027172550b7d5d0d24371603b52524d6d7fabc05fa74728b0f913573c2003733433f0c15bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2fc1ec54a108d6de00f53905d04a34e

SHA1
cde140dff37468a927570a5f367ec71a8ead5875

SHA256
5e5385353bcd8b50b289aa03c13c9bfd90c2ce44df0217a30d0a7d8c284ccd5f

SHA512
31cb914548c1335feb62bf4bf2fcd043075a9761aa4c0c8e5c7bac71f3c3697eaee4ae645e9625101a9621bdf3641d8310f4bca65d5883de8eea285753e5ec9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
275cb4587c674e68f6838c6bf760272c

SHA1
c5dc78dc17a32d66cceaebce815a02ceb2eef740

SHA256
78f1ee2c61dedbb328c7b50d4deac2dd88b6c4a2a4819ebf16c956da2a303f0f

SHA512
0c7643385a3dc6cb231353e0c19a83893b10c9b1fb7e1651b9510bb45f346ba71bde7473cdfeabdd392660089c4a7ec9c2582b85e756c132087147ad3223fd55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eefa4cfbbd3375d97089c4082b5c013

SHA1
32f488d4f789eff838c90f3a7c78ca5daad268a3

SHA256
1ffb7a11b246d89be18a8f1d9a63f669bd5dc6b119f7b6ec7fdc2be9f05953ed

SHA512
58138d3d4de7e0bce9cdbc787059517b7070790c77d68840ece63c3bc48d4478e202b0624192e7d900cb0bb53ca5851d1756d7087a8eeca6d081957802a2f2af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47a0bbcee83f49491da8fbc0b201bf9d

SHA1
22b70e3666db7bc31a4d71451252c1e3fdedb6b2

SHA256
12b815147e46dde5ae708f094d52c831706d75bbdb24e491cfc1af0b27776b22

SHA512
c8095fcc17128a7f02d2894470960aab5e0edcc296218d37b87787857c1b0126cb1427a022a8076bcdc3b75dbe56215e2c7a5acf439d67b9d982855219c6ad35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0df1d14f5035806d7b41d87dae97ddfa

SHA1
3bc7156ebef560279ea8247bdb1e6f713b052019

SHA256
11b37ccd0e65978760ba15a5250d4ba836b7bd56a6162e1af4339add707636a1

SHA512
fd55cbdd44eb54235b118aaa08d61294882f14fb0406f6a5e3bb93bd0d06059024f10bb044f1c0346e9a1b75c193d1aeaea7ea7989a3f880f8c9a7b6361c71bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e66fea3ca9240651229cc59cce346962

SHA1
56239a6956b7d4eb23e5d46655c1b439845c741d

SHA256
6c04ff9fc0d50120b85c95bba6b13522330cbcd8737525f9c721db00a4ec281d

SHA512
fd14588a910b6b09a498e3685bc29e34f2746a4ce21fa617bb3e66d7c51ec47c198fcea529053d269053f1bb01c51662b9bd28c96010f13a3f3bb07ad6fde152

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5096e9de084439533abd8a1677f841cb

SHA1
c59a28a608e9340175e5e740b5464ac59db18465

SHA256
f3a7388c983aa9c24ad4b7865da0b6f9d90b9e601dfc9d71ed8eae16234639e1

SHA512
fd1f48b2e176759efed08d72cb431e80e3870e2748aacff481a0d8480a5491770398edbff851883ed59fbe68154ed61f7a881f525449a4dd8b1436b32f035cca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d52c2d01ec464971bf823446a46e310

SHA1
9a95b5100ff5440612f876ec6868a80a2612f8ff

SHA256
e525a66c8b6b1a9765af778dbf43630bc2c75a4544168ba50f6beb1f5cbc27ab

SHA512
0d019f61c85e217f7bc5a377e4eb010196e79742038a8ea2b25ddaba1ed29d57cb8a244aea9bf2e76b5baac637e1b0f25623ed93e7da3302f23c1d51cd1a1f6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
187952ca92a901ace17083a55acf731c

SHA1
9ba0ac643eb0e2625561086072aa7487be928aaa

SHA256
1992951676a0283ef054c829aeb34bdd8a891f53539a1ef0d9625e2c03a8b0bb

SHA512
796b389dc0ad60f56b0cd83079d6a3d9255e8a2c12fa705b66c99ccc22442d7e6d990d2faa646b4b04aa8ac529369c52b7e55e677b70aeacab333502cbc2008c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cadf9477df22af31336080a5aeb2ed13

SHA1
77d21e5341632cd110a949dc8c00c0c64dbf7b18

SHA256
9c510d39432754b59710761b943c98e725aed13a0f4e872f5d55a2a2473b007f

SHA512
275ee2659fbf405b0706e2ce93dcbfbd36d3e198ad36518104ac0ac7eb189e9ecd7f4ff55f1e764abd6c7407ce4550d067ccb1d4af992d5d1fd4804f696a9cc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b443fd405bd01f09d9e6e974ab1901d2

SHA1
5a9b5ce832733f96c7698fc6fae0e96e3b73bedf

SHA256
dd1f45cb81dfcee06eed4c66a74a3dad042ba8dc0465dccfeb578079b3c2d2b8

SHA512
892299a0530497fd9ea88a9c6154c32ca7e4e12b83aa21e610eaff052db35619994a35159402478867c21e091c216a8a8aa41ccb6086481c2fc6956379897d6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfac1a6951f30ad883a56bf781e9da23

SHA1
5f95b8bb438392094ac730fe04dd33f1406cbb84

SHA256
7cb0c1e0c4574a2e246a736f2a622539981f5cfb102b64ea88701a5185f77d1e

SHA512
dd0f3ee095eb909190b7921c142eb39283368cade6cf0bbba8aea056bbcc2bcac5db09fa6b113bb71427c88f4b62f67be94536d6cbb41e001b25973d0515a91a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc8828ea276d9396eadfe83eadd200b1

SHA1
af3af36fc1899ea6e2c2dbc2a7cb9246243542b5

SHA256
72305ead178056607824957dc7f8dfc1a9a64a747d72c139782abc899bfd5bc6

SHA512
e8db7e5fb0e0a1c1cadb4ca283445b4027516275f176f251d4a41261c65795e51644e50f6667d1d155c5391f41784cd0af79a2b3513db28c52a2b4e873b16250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1YVWL6AI\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFFB5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit