fd9c1a3866507ad1fdf0f25cdc3ac137a9d6ba7726f55294bc6bfc29226f5639

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25c108e959e9ba769b31138171e1fe2e.html
Size

65KB
MD5

25c108e959e9ba769b31138171e1fe2e
SHA1

66ddee34f2d185530528cc0dc5e632addadfd8b5
SHA256

fd9c1a3866507ad1fdf0f25cdc3ac137a9d6ba7726f55294bc6bfc29226f5639
SHA512

db34348edbcd28a46879dd480e2c66f2d66f0a79afc2f15c11f39e3175ccc1a33a03e7611acf8181cd736b8d0e584c609ce29b8e4647e7cff43de577670f6542
SSDEEP

384:SIFVNOk1YCJVsHQSAGMY8KIQOwZj6W+kIdMsMCD+DXlwVP:S6NO8SMY8KIQ5R6W+vdMsMEhh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30cf53451c3dda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000005130a7c2c7021c7f8fe241ad5784e7ad66d57934d7da203eb6e1c3beeb0251b8000000000e80000000020000200000000810b7cafa07b56dc0d588b9becfb5b9d6fb4371f0688c4ff62ffa3fb997860f900000005548ff98342dc5cf27d7a8a4d77025235ff66fd29732c88937d01302a13e12a5d8a3718f7c19d7f23bf870737a6f8e153a98e9e8b9b02575e04fbd15346b8c5c3297064e30358a6451397d9ce3141bb57d14a9fc4fad71b2730037986a8bd6190475cb7d2d2c18981998acc0997037784012851f0c7a2afb8778a799dc5be0a3683fe48bded70596db1478e486f2f1934000000088f638b3c3bbcc4bd56cae3a60964c0363927c3aad2b76aa10404339d23ce426326e82ced48818ab0e62ae137a062b0537cff791e9809c4acbd2931220574589	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001eab00d659e0d2af5a5a53e98530714adab781ffa66ff1d9214ad027b1a16b8b000000000e8000000002000020000000f363a924403f91b8ea130a0f20e1e470a205a55cfbf16a932b1047763bd9a118200000006d9586366312f68ce1f193b31558e76abba46ec4a491f118be27c993f9b4c659400000003a40906a95cb79be4c8a313df6412c16813429d5684a59f2893a62e8dffb2d21ea997dec6255b261924239bffa958a7c9beb31e086d1b6d5760ea84641224427	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410321281"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65B36FB1-A90F-11EE-B9E8-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2252	iexplore.exe
2252	iexplore.exe
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2108	2252	iexplore.exe	28
PID 2252 wrote to memory of 2108	2252	iexplore.exe	28
PID 2252 wrote to memory of 2108	2252	iexplore.exe	28
PID 2252 wrote to memory of 2108	2252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\25c108e959e9ba769b31138171e1fe2e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
171ea1113772638ce5c06bc893347105

SHA1
b64710a45a79d351822a012c6d29c7fcd0391780

SHA256
f91b7668257a90cb7e4e1d075d7b23f056e13c18200f6aac2fb67b53ec18aace

SHA512
cc93aadcb1193c690e6c7a03518c11d83e5408f6e15998fc9e3d2b7cba5ed2d1c5b0a2fc2c1e1d8250198d1bad465357e211c9504c4fb2e7c3abc81ed104f185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46db8ac78459177e17efa7fc94532cb3

SHA1
26e58a043629d144db1c2117564876655024447b

SHA256
957e440c38473a5b10bac9bc7c6059439f6be4f5dd38cbfab86db9a7971ed277

SHA512
0589cea80a9ea997ac52a8c05589a3441b13369925f65705f209ebad0a3621958747be1d8dc60261bd992f1cfbe3d95f4e1ef5e3dd995440101334aaceec7771

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39e0ab3642fb59b0f9f45bb2bbd8ea7d

SHA1
cde5620a498e1387293e569af31f598998a8508e

SHA256
57de1cf384d1e94ee088b1da7f8ef0eef0e9ef1997e612005a315a018f20320d

SHA512
8104b12f4cceaf7eb52a056085bd07cade9d906e16d1465262e29c5664c6a5929bb2f521b6f71868227122b68736d24ef3e33c216e25c7912d17f472b10db9e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5dc40f2aa20d32784a8721b8e2d1e80

SHA1
8287a5393fd8cb31f8a08dbe8e37f84d2a61babd

SHA256
0c17f0cf46c834d8737d9b7febd3f9e2d767941c9cd85e112ad433979799609f

SHA512
2b770f5ea1b0cb63e7c31edb1751d0836ab2a0a830945648bd8277177c0143fe06aa230b86e557c6e2655db146fcac7dd6787fd7a31b3224c4c38d6d17a71588

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cd61362bb9840d92aa2eedc263cc995

SHA1
5ed5c62c2b235de10052df46eb6dca9bc91c6b77

SHA256
d8e9efe2496c31b9383710143e2193a46874334741ac94cd26b2057a43902101

SHA512
071aeb0e711d5a7e4ae9ab4e7a79cbd76a917bcbfb34ce70a6b0bb71314703b6c9cf328ac9396cc966321408b6f91ecd2ce5372b05c4f4e73f36f4342ec737b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ef4fb7c67c8cf8defd6890c9a9772b2

SHA1
5e8be2d2b6f3662a75f9a6d8c1b4ff1d5b933a4d

SHA256
b56adb4e8051a0bf2f42046d5e88ba46e49f5ef467f62950f33cb1106e40150e

SHA512
6e4eaeffeb07e8994843f79ae0bd529e10c3224898b0337aaca1795faf458e9d41755a57719f2a3c845ad58446d05c0bd9b0902ec3cf944eb39c14665902b4d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5376891d8ec4292d47847d03e2b6ed98

SHA1
75bcd6807588d73b9ee447ebf04dcbd462fe2d6c

SHA256
b5b15e0d545bd754ac033bf7424c127d4867dc35159436e0625c4cf57e9f219a

SHA512
15f0fa397c393ebdd655d33d0831e40b75c0b434b2c54fd3953fd68d105dcd0439abe1d141bc1a5dbd07f5e96b9fe49d336cfdb36e0f2826701d3209841f1c57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e5fdd7f8a91419eaf1dd90bb7973f0e

SHA1
40083ee2184030ea2c1e8c3789dd0c417a22d6de

SHA256
ba3f87da972d3473ba6bac974302ccb19cc8d4a6b3d72af0b93dc16e334a750f

SHA512
54957894a75a10db63d1431ff98ded67704657608031e38189ff0b0450c09a745e228b3cb0743b33397c935d188c108305df950d4221720630117805825a10ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
307487a613ab30b7dee973f9ff4567fd

SHA1
aeee5e8a9ebe6dc79bafdb8df4af6afb93a99f3b

SHA256
44ec80642c3e4d38c8436e5d98eac6438760136d0b52dacb2aa021dc5fe5d18e

SHA512
24f1eb29d4ba1222ee2e469a341f1f022ff63aa8ad5bac92421899271ff71b7ba4313b5789971037c3f0f548c8bfad57c55be61b97413f69ed0b4686f1a394c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59a2b28403b8b387e4bf9c18f3c628ac

SHA1
686c9e7023a15299760417ea693068fe1bb99768

SHA256
e426dab2dd34d7c9fa8803077dda553bf3e7af4dbf670946bfac4f38619ef789

SHA512
8e23364b4c0d224e016dc80f2227b9c3cecd41cc958cd3aa3a83364ec6e17e8e6c8cf417912e65d615160d16923e6fef13e2034ced7bb2aa5f8bba2fc748cf6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bbcc4e727bb713eac77d06bd3702a44

SHA1
93a14c3b887501cbd42116a0989472f5768a0572

SHA256
ece72207a0a1bc2a8cb20ed73b231fbe65e376b455a357aeadb6d977895da98d

SHA512
762162f799c515ba9539fdd548fc2b12a505c839fbabb4faad523ced9b2ea08fbf1429f8cf430e758e645f1c7b8e0d2a5c61c41c903299c8ad6b0f253b3760fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d02edc86309ccf9ddc8f5ffcd4bad478

SHA1
59df17da487af99f69a31710e98e4e9daeafd0d1

SHA256
576942a0269e4bfad875483370ded00a86e9270be279f1b7b9605f3a58798e1c

SHA512
b1bc44005bf46f2f8234336bbc8d8d4ab2046e6dcf3bc89363eb0f628a5f65020df6c32e86310627a12f6d52bef3411ed6970f367c58dac277dffb11982719c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a12730765654fe1419fc023710d314d

SHA1
486fa1eb126cb067bbe52da61767ee774488b4d9

SHA256
c7f10acf880cc1360a4fa5729de486041ad856111b66a9c92c5721a058b607b0

SHA512
54ef94cd1f4851aed0ec3cae5d6e2156250ee6722ec8d3d6d21e58953d3a458ab72ccceb827867e63e41b85340a994f1f09fdd225c81e21b61765e5f05c461c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33155b02d6bad3c2fbf065a6f351d525

SHA1
01d78a4409d46a196145dbf6d3377cb17d2d4335

SHA256
63099e772946b6607014049294f01fe13ea722a2c72c63e06405a0e637982f47

SHA512
6ee06e3f435b2aad8149710efdc6f0b5229d4a0b9819482c62707a4173ab9a956fe0a9553b537e959ab53a8c87cd9f3cbb8c51275b5613d55d377dce7fcc8401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDECD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE008.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit