146200e0b6dad393e3c4325ff9ceda3f8c988550a643470cae3170db81a17df0

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2502f5f8b9b2610c2dfa2dd688b719e9.html
Size

41KB
MD5

2502f5f8b9b2610c2dfa2dd688b719e9
SHA1

258e5b53728893564c31c8e6a17bff919aa6579e
SHA256

146200e0b6dad393e3c4325ff9ceda3f8c988550a643470cae3170db81a17df0
SHA512

260630bcd1bc0b4ecb413dfafd6ddaee51e8ed9d5f634101d95691a30383b6a2d2071002f4221af43b93ca142733e8e708bfe9495253512130f3b700e978e3c4
SSDEEP

768:4vF7T1QfBTrXYIrExu4MwIKa8D0bYF2QwYKmS/GCkLPZ6qIzoPEzbybEBnKJJClR:q7T1QfBTrXxrE3xIrUSOwYKmS/GCkLRQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410600473"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c8325f9658dea5d1b7dc608373f251ffb58a3dc0f8c7098a387133184348fc6e000000000e800000000200002000000003df7a1cb941b992b36a4a3e5bce28c779288e0f1327d1cf67d9599d907a6a3c20000000d8728f80a5cc952b82191a038ff11b9757eaddd3ffacaad8562ebd99fb3677a740000000b4c665c3f3d3161c554835dd5a420a04b244c3e373580cf71724fbda99355f966f330385bbb264967c9ef600ccb854964206448e8749f3db53c46545d0724fcd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{70890D01-AB99-11EE-9B21-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08e0e4aa63fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f2519870e22414837fc1b84c70c59fe26d47cc7fb5ea39d0287dbcf8f9c5456c000000000e80000000020000200000000f2776796e13a8838e3d16d41c9ee01fcc2e44c161d0d6a8b05f2dbf07cb0edc90000000025b29fd089129a5a850d4da415b4ddaaad08bb38259d085d9114b35e3f719bfba06dd15a16ac0503c5bd9c26899dc20c9f894a4dab9e8129a793299de9246ea5e11d129b67a20f61ee7a0f4477c8632aca5dd10b56ebb43055e104f7670b018498f48c02469ad0d46fd6323d7f21df7f97386cb7ebaccc2e8dea5411bb4361bcfe158213a37759fc1604511a24cd6e3400000006420c60dcd1078a32da88eb62c554e1e2ab06832c9fcf256c13ac395d3b1373b4a1d10b574d8cd1f5a5b78d49f89d7325e63e684d40d223f5d372f36959ec0c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2100	iexplore.exe
2100	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2472	2100	iexplore.exe	28
PID 2100 wrote to memory of 2472	2100	iexplore.exe	28
PID 2100 wrote to memory of 2472	2100	iexplore.exe	28
PID 2100 wrote to memory of 2472	2100	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2502f5f8b9b2610c2dfa2dd688b719e9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c99fdbd42c4df5f28130bf58061c83f8

SHA1
66a0a91c5559a9d14fb4600f2b51fcd5796816ab

SHA256
97e8ce2c069690a28dab146495a44991f56a45f5f9e422dc7e18632f410e02aa

SHA512
12415f4b4099a47bbd9c90917678183f426ad3ba4eb5c6becdb789c9847c3a82d1997e8d5c2b4ca0ea6ed7ba3fad7cf4124077ea66d9ba52cee9be60c9e186a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
555b5509d703d51ac05e1537cbce4103

SHA1
42d4b2613affc88292a5d2bb535d3a5bdb39db33

SHA256
d2fb3aee704b385fbf66f1f368f5fccb2c02a5a95bc098b15c8e626a3ee157db

SHA512
96995d8bd3ecd5c9e49873ff3022e4bfb1765de00ad9f78139172b69b664470430f412d7ce47ba7678f54fdb2d41e1542e02f581ef8ec98ae95948bb52a986a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
855f2ea6e2c765d07f726736378af8d9

SHA1
551b80d6ba99b2d5691a4b3d9a2960db2db7f0d2

SHA256
a6a9f2f3779229bbc19d5adf6e71ae9c308b66a275ccb50e5946bd08520a536e

SHA512
669108b15c7b09ece9381a69ab129832eb10bfe4db1fbe3caaeeb7d9be4685553502a2fa9817fda41c184b41ee4987ca3dba42b704c3e491d8b86ec724f066b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6082a9e7759472967ea75600785c875f

SHA1
8981baf0f2c277e11ba07fb957c0d7e9ac3d1526

SHA256
1e2279769873dd588793fbecdf04f41c60b92b0044f7fec9bf716f19adabca9e

SHA512
3aa78353f2c35c83976d311102d82ae0fac3fe8b4daf7081bfc15a67dd764bebad692bd590a19cc6ef054d6fe24c37a942d6d7bc4d8bc8732af0388f7060c228

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
027e3715157794cdaad68347ed910ae8

SHA1
1d26501037ba9cfe396d91d9c641de4de961d4c6

SHA256
d39bf7e1fa0b906170088bbce742a48786f568658b2c462b316afa8a26a926d5

SHA512
a1fc5b2d7e483eaad9c314eaa94996f8019d1b4304723268b086556b4b3dc1ed538f4d47893de6653a39c49c1b50ca7ee06ad8c6bcc89708629edd22121332af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
340f3116e82a04661c5d684856bcf65f

SHA1
68f66e962ffbc50e9ba051b9e43b704a246def38

SHA256
abbda45758c7bf1086e2ec9fe03534c396941285575b91fa18267f4264c66a0b

SHA512
2fec306f666cd402e88312a78daedb21330be2611a7d254ac2c6e7147eb8a68704656992ecb8e33461d2220cd1ba3c617e66415a5a8e53c49dc5e2c5bc7d07c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af544158ed74df12b9c4e1a1c7e19271

SHA1
3e31ff47c8ff200c54ba3a1f1542c8190ceab161

SHA256
b09ee7d1b2ac399462ceb04268e939dbf44af879facfe6af9bc7d19feb9db31b

SHA512
2136fa9725cb784021ef23db9e4c97c95f5ee83ce7449a3b1811c19776df3ae639fe3712321ced080175a86851df18d6023e5ae49690ce2046cbe13cb14a162d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
437879fd4ee6730ab2ca476c2ee7ad61

SHA1
7ad4cb898a89ebf9c8bb5c2f97a51bd137794524

SHA256
dbe646e225a6c379858bbcba081f837e348edad614cafe72f4a2e0f59374245f

SHA512
7944d0177ba8461a6f27846eb6677e68c9dd2923eac4432130becb7734e69a52b6b5c101d89049a402c4aa3ce92745a6236cb5c6ddb532a5de228c20a35e2eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c63f898a8542e55004210c1abb84d38

SHA1
58fe8b9e19c31e76bfe25ddb3f7b44d7e3e27d5c

SHA256
890a0b0a019d06cd64c06a41ec678fbb60a8964596f073880d66750fb75fd388

SHA512
5d010908c535b01677ee79d66fa957e93db3c5c09698634906ede7cad47451da4bf2afd3159f3fba41820dd4baea201b50932eb8f9517be05a671a2854b8a21f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e79759d997e85bc9f9ceda0baf1e13be

SHA1
cf89b8482f075c654a52d0d212e6a0ab68b6f73e

SHA256
ad954019dbbb4adbcc0f01b7676ffda9acbc32f63990d0a5223b67451a6c145e

SHA512
4ad269c7fa840147d15eb776affc70fbdf816a78a51bb8687f4703faee74601b2af47f43eedc09836d4efe4de155a1450dd7c473c0e888ebe63669cd7ac1d262

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b33e9f3dd9d17d30044389a3bf51c8e

SHA1
ebcccc423d36fb9813d668893791259eabb31aa7

SHA256
e780f15ffe3f10907bcdec39e4601cf5b7344296ae6af172d6748250c8bb7293

SHA512
d27455956f7e1d1ff4ed64b3be5d9e0f2cc7470f859c0c581259cd53e08cbdd0c8e65b53bdb55fba31e6ec2c829b7b0cfba045279fe7bf9fd444fc3c7711ab8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
893fca83531c0929c4b37fa48e2a804c

SHA1
c4d1d1d48d2491bc1f3ded48632c6c92de344ecd

SHA256
cfe4a6614d877eda795dd824694af9c9e2fdb3d97e8b037dcc5a3a84d6ba7506

SHA512
46d69d8e22239ae9f744b4f97bba4f31cb49625dc3630f34dd0d154b9ad34d4b6ce60f96a172ae8b36d41128e38eaaba5e3c47a05339b8f387a030b84eb15843

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c310040d2c5198b54f046bbd35c69b27

SHA1
ec3fd1aa1cc4f8fcde726bcf9f8d2c5258b96da1

SHA256
d2690e6e8da9ddc80c52c527b276fe8ecf6a3fee0282bcb10130918f5d0289bd

SHA512
666bca5a77dd77a81a034e2f602b10790e785eba3cc0b356bfe6b822db95ddf6558a4dfacbd8367ab9ec123da10f90d72f2469df9013527cc25e318696c33117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0088617c6207a8bb62f10fb4f3a150d1

SHA1
52fdc7f07d003c401eac118d1e57bd25963461c2

SHA256
5fc2ae6914fb61a0398c63dc308f17e961c1e9188d3bf91a182e96f3fdf24894

SHA512
f41ccef64dd78faaf9f1f6e2d37eb44dd204d1f4e504fd3486dfb9800b1f3547008a83f1c757ebbd082f92ca0a820027fe91637a9ce713d9b197b6b758154d28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6b023e5e1947d170ce8127e7c435fae

SHA1
c8d04a5e481a7a0eac173b495447dddf8604076f

SHA256
408362c0597380c1f86f58e0826ce88a7fe74767f486a9b82b30f7b82c3b1821

SHA512
b8f77151761a458fab6d750e62d16b69f33c1f9eebc59e814ab0c5266441d03745b5be192b993c95753826c1e901e04b0bec78593d7d3ddfb921f5c96f9a76bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE2C2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE39F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit