65a799c55fe451f8ceeac5a2fe37f4095c9e33c3269b1a21c8a4f1de81935452

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23d2a09de16a6c1d68639aac939d04fb.html
Size

19KB
MD5

23d2a09de16a6c1d68639aac939d04fb
SHA1

7e4ba3bd3e542e7a7c86de15b673fffe6322403a
SHA256

65a799c55fe451f8ceeac5a2fe37f4095c9e33c3269b1a21c8a4f1de81935452
SHA512

dbcad6aef38deb741c6eb3b8c3fe590760b5eadb7f7985e20ea00c559f11d094ac77b7b35b73496ee03cf9565d5cc438f69c50ca2ef59892ea3bb7f311dc9005
SSDEEP

192:MxfGjeF0VY9fG/ORCqXSucZOKBNAMfrLufQE8dXLuXYcfNNdc4BlOiz3tux1oUrp:sfG/DoeOK9fnaQEsbGYcG4BuVZ+yrJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410306615"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F0BB741-A8ED-11EE-834F-6AA5205CD920} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0fa531bfa3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000091dfcbc2056e9bfed5fb66c87dafb2cc32a51b0ce853e5989036910f26ec55e8000000000e80000000020000200000006e343a1d73756d552f2232722c4751773be520f78673532ba3088bcd4ca59b849000000082d0d1ff1f1ea6aa22b72500ac98b9efc950d08ebafe574e73f4f5dd1dc32207f448841a83837ef59f3ffab02e480892cedbd05a14e09e0d1dfbca85a2ad005928d82febf3b58c666ffb1367e6a8d2aa9fcfa10e54add7b4df132775b6921e8c39bb37416c6a10b7fb3913e3947ba9de20c8f1ba8ecdde49b32755493b0613b0ede6aab95cbf48ceca7f865dad2e706240000000d03ec8e49b7fe2195126315cc10832b3618f44167d2a2e6e3d2ce4ce37d682a9061c20a5cb7d27fa2925185197c3beac2589dc7e6abb990c06102693fcbf678f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000f84fc1118319b79693eb43825030872bd7dbc08cf0ed4e25480cc553c7269abb000000000e8000000002000020000000e4a1994444d2b683cca42843890f9f1aa07a1a16ca68947ef3119f607c135ee32000000092f8022ceef73a114b75b39425b6dd956bbd041a050ef966fd187d5d59ff20f040000000cf673733b01d3352d75f121e322134f7617ef73496d129c2169e5802d0294e3d4619da3afe121b987dcffd9cabd5d081b7b4be845f1c0a9d5f40379f12b83472	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 3020	2980	iexplore.exe	28
PID 2980 wrote to memory of 3020	2980	iexplore.exe	28
PID 2980 wrote to memory of 3020	2980	iexplore.exe	28
PID 2980 wrote to memory of 3020	2980	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\23d2a09de16a6c1d68639aac939d04fb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f408f598747970aa9d52a4693515c32e

SHA1
fdab776fa35b6674c34703d6db00a852b0c3af06

SHA256
9c510c93626e1cbcd7739b48da7100d3406824ee1dbe047be8500dd27413a6a8

SHA512
b07ff9b260257974afeb8068aeb8c9361cd0d46be71591c2ff184d81ed8523b95a403c1ceb4c7da290c50ca55cbc1f0026b6933af7c46336ef2266e0db8e97b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55066cf1df6b87fe3a7ca19cdb74680a

SHA1
37800856844841c6fc78dc74ea7701425b0b8895

SHA256
f191deeec59aad8645442b22464fc47c2cc6318e3a34bcf1d853f3421193c342

SHA512
5c747e0f90becd14a9e7acdfe3162db4799abc7f5db08d784b80c4eef9cd0a540787954a163019aa28c16c01f2c3ec152afea6b4eab98bb959eb866047fcd70d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c6dd0a725d95acacd3587412cccb91b

SHA1
242b054383bfa9638547038ec10d9064281ca088

SHA256
bdbe4b792d148f7d93d8ef384f1b2cbaa0fd96462773912657b86abfb3faecce

SHA512
6c70b944447aab7c5021f5f85ba4c519394e6a485226a89c5aaa623b7a760c438e78763513336f5755324c0410ea762174f02f5b7e189510256caf56062c9b5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
790239465e680fd59828a0de96b60222

SHA1
ab7c6fa9253dd7df50e769c39f4f35e12ae7ade0

SHA256
d454d6bf8dc475be17c33fed8f944a3c921c9980150297cf968051e7ca7b44a9

SHA512
429fa52780b9d886a85b488681a9d1d0bfa9246cb7f4e7b2c350e592e8034503217d1af2629f28d538086c0c781bc24c6e07ba6c90600b404bbed7a77bcbafdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0ae0abd784be2b4767defe61cafaa84

SHA1
e85e110783793c6bc8b9762f2e44f9c20eb81a30

SHA256
4b4b6fd7929e44ceaf71eb1e9a53a223b90c82a484e043ef47b1275bea158878

SHA512
c61fe3ec654dfa6f3d9f566311a9f10ef12754fb75acf58da6601645893d9c101f529db00be5aa63d13dda55671ce4778023795477064ae853a6d80e53a31a13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c90670168c1458c38fae1acfe89b1adf

SHA1
62331f635e8dc02df08657e0c6769cfff032a702

SHA256
78cde010c3e69fe821f36d8d5a66c212ca2cbbb42abfc626c047ce659672712e

SHA512
7d6a326f9a1d53bb1e2c74f5b5a822559240d5595adf3edcdce28efc6de1f84edb292c568c246e69d1ac5bc5157a424be108e605b57cb18085808d71ca7718ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e8187e5b17c27e9d7a1d3285fe6d016

SHA1
dab56e0995dd992a37fd13a0c597f7f0b33f9fbe

SHA256
24e2fc2d851105abb9a513ba780e9b152f979e6de20db53390c95b5826bc0747

SHA512
32764b0f66ff96fe58d778ff617cb3176969b99ff1ead910fb9fb765e288e2f21f514cd9590c56ae795991e2cea3ae1441d1f2d68e9070ad7aa84dac7dc7c4af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e27ff8b8db36b8848cad2957c7cb28e8

SHA1
c31ef124832e9a658418eba194288033161e2b42

SHA256
359cc4e16d116a79cf1e99d592a144eaac655c74d6e348a00dbbfce0155b32d1

SHA512
902ded211dd57e06388e7c1dfcf188aad5e7fc206c496f581a9cdafb6d2433c65f297ea48fac94e9858972cd50bda56eb79eb62003c401c9f132debf50323b59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
652df37be0b187c263eade29d7075045

SHA1
d56185dead29aea66e73f700e1c065ad2b93a39e

SHA256
b103d78f0a3ccdc0fe67b62bd9419714030696f2092f26892b9402d330633ad9

SHA512
6f4da9bae8f6440aa832580bdf5c5774975946c9b6d239038be1f0c7a24b5b585bcd9d05d982fb972c68f2c157be974d40bf0ef2bf0b4bf25f9b66c9c3b02e79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
80f79823ce0149c98179442c3f1d422f

SHA1
86a30e6e8acea819d9df27e9ab087ded42f12a5d

SHA256
e5874e0f9002a2c52262335dbad9d8dd5229a0fa3b3eb4e366ae92678a36b167

SHA512
a21bcceceb0f7dee5b877d7c45700bf146da2e8e9e51c291e145b35a79d3331def3a6584894d8b156b247b44b697ea6e1add294df393e61492ac2bcfc7295265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3854.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit