5f36247862ca6b9db6534630bc48d9bfcde34e791ad87e88b033aac178a66884

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

287aa22b3456e68c7b4e8830f260f33e.html
Size

42KB
MD5

287aa22b3456e68c7b4e8830f260f33e
SHA1

d4faeb3c36c0fb57329bc7e7756b1719f3e05237
SHA256

5f36247862ca6b9db6534630bc48d9bfcde34e791ad87e88b033aac178a66884
SHA512

352f3a6cf1851a7da9735f47c0870ce31a0d92781140c5d4bd1140ae644a36772b150b3d8c12c0d97c602b4ef7862a264e9d285b681b000b98ff87de3690aa93
SSDEEP

768:+4ZUfYndBrA/AARTESAErISOsA3gDGTBb5JyjrU+JD+Dz8t1EoErcEjA:ZZUwndy5VooAQu9U+cEjA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 103070603f3dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000052c12072788f09acc268251a274cb2410b2c86b038ac3ce7203732675b1bcda6000000000e8000000002000020000000e02a8a27fe488f1fc41dff92b2681aeb6b9fd3152bd71f668ed82aaf6646900a900000006b4aa7af387c172b8a6a35b83c6a34259ab114d8bfd94162a10c556b9bbd41c80bf268e1c5c17cfe58800969f6a9102ca1a118a9e8182705fea37852edf8d0bf0e3332788d999d15161061d0a5e06225fef05bc24589c2f19dde0c96578982c0c70a55c995427da3a54535a6afddba3069d638deb3c8567da4e465fc1c84c25917a167662207bd8c8de70a7d9b45d1fb400000007d4285cf5bd0093961ce9174e23e9171b6ddb251d42e33863da8b05d0b70458e79b9312cde4a45cb538d43e8dd93da0b91b97fda0297c5abe2553ac0c21e0b30	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000001c7e27b8c58067cfaa3c78219a4abff3257a4d9b35367145cd516a73f0470af0000000000e80000000020000200000002ac944330c45e8335899717227f5a93c70a6aaf0cebb1a241a2f35d28bdf60f520000000322be1229a55e4da0bb3112de93c7ff8432dc0b8e5659cf5a7146dec37f7360240000000f6dcfa7a49f81af2701ede6e8355b83b7e9d8a6825fb73d9d19dad4b02ed8649788971dc41c882b7713206af21cc73658ec2ff505096413e183790db0a72c76c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E406381-A932-11EE-A2F4-C2500A176F17} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410336358"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2768	2240	iexplore.exe	17
PID 2240 wrote to memory of 2768	2240	iexplore.exe	17
PID 2240 wrote to memory of 2768	2240	iexplore.exe	17
PID 2240 wrote to memory of 2768	2240	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\287aa22b3456e68c7b4e8830f260f33e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f641ad8aff2bdde0b2b8879fd2c1cc31

SHA1
2e3e0be7c6062d79c0c159d0c8d9ee02df845909

SHA256
0cdc688b3bab9a31ca93028c049bb93b2eccf54e6bc7357ba653b4ec8dfd08ce

SHA512
a12cce5ab2653a95ad92aaf8102aa9068aecfb0c2e03d97132eca67535f8b72d55129e783d722c9d839158606136e7bfc0ccb4b1f44f09e5ac3691530c993c17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1357c0d894adfb905ffbc8c337b846eb

SHA1
630da1719630f5fcbf48c289e59b62d8dd5645d3

SHA256
81a0b5898aeca7e8a7fee7268dc036d3a01693f411a833f0e433d5eb677d18a2

SHA512
c3cf3fdc476d7f0f3d29d95bbcf056d7fc1012fab323663e4fb48c4a293a4369428e6b823c0b36c6e0707e99c922b52d7ffa82ae3bf5d9e4f4b6a8f44060c00a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae747489f51c682a64f5e58560f52ba7

SHA1
2f53b5f9d4d5bc3476e06d020a338a502eb5b39f

SHA256
3a27977f92eb7b693f3ba17e25f9786329c16a1f0d4e147f9784c0a96a16c57e

SHA512
eb937b829854245df4765dd2fa81d89eefe59af37c1cc57c39b633c5a9fce552c60056b1c28450a6c019ab9d4ec36531656d27de36186dd24a535cc98aa4f590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4c44758195108ed060af6171a76dca1

SHA1
c3e43bb5b2fc6778c8986d94aa16f8bf6b8c3765

SHA256
baac62477d4c97011de774a96ab73b53678a19be982450abb35c90e6b834364a

SHA512
37caeebf405c55ce678c2da34d5e7816b77935cdd7b686b9c1f92f51048dba2ea49758e571e240604b0ee5186ff4baae9bcbd440b61011db7ffc68b82d61e241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33651bd403d9d317a6072a5fb3f8ad1c

SHA1
0e16c6385844f6e9df7641d97741aa2eb168c69e

SHA256
ae8aa340c9b369f764d8ed09417a24145278dbf3cf80318b4c4171bae1897c9c

SHA512
362c40ad1f9ebb12c414c3e01e7321c7dc64c14623fdfddb412df02046f1a322b57c2e940f3ffe92582b63efb49e1ba7eed948589c8af2bd39c7ce7ab2b6f310

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9716cc675fa7cb0d16257583b4c055b

SHA1
3c61bc1df2e261d7ba54c7c95716f8ff6a635f98

SHA256
74bb9f0d4bd937ac4b3d6ff69adc3f7f0266d3d0d28cd68a07a61e6bd2ca403a

SHA512
4aae050d35d579bdf726720d5c3fe7415f2be9ec112d2b5b4a6fb7d6ef08c2bb695d426d7a420182d1105ba86645d66ba2da45a6f9559ce6d010d8dcf6f9c1e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8623d8037376271e04a92bcab2659ce

SHA1
617bb093fd8575272861b7f9c80f247ff6c44e02

SHA256
91681a29c77225ce5cb288700f51b4ca7c04fb3cdcc72bf7cf117f6a2f487d73

SHA512
b7b639749b1be49ab76bf680501c88b1dcf8ae39f19c054202fc4f83604617b6bda5fe175d757f0927b3861c36a262887ac56eac27699cd6e1223f6dcca3010f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14fa20ee59f0344a78c44c7500a05860

SHA1
dd6e5fdbe08afbcf9f5fd37ee1a69ceda0c3d10b

SHA256
35b3539166f9ccb4026b8db28fa28817f5833128ec8a361aafe67f1606676b14

SHA512
d5246982a9b79e44da70c590e1ec6040979a9742fb2b8aa25866bf56a95f7d70b20aba0c8ebb9eaddadf3e90f5ec2d02eced171c3195d46d3fd6bbed868cf04d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ac8c5d4ae690eb976db6a34a04d63d0

SHA1
bbab0e4c1f3eebd543757e13372ce59ce44bfb8d

SHA256
7f3ef1c42d2a88349a6842277ac3d06337097d207198bfc9f111e9b74cb86ae9

SHA512
8c27d76b92b659e612891287dce312d954225d0f56a8eea45d279150e7d9598f036764986fa6db2fd913c4fbe529419ade3190140ec1d7d3a313014b86765df6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5858f29a86495f55ae85185b66fb1ffa

SHA1
d51eb935fe71601aea284fd14ddeed06e831426d

SHA256
7309f3db10d7fa3db0512aa1b982a6389c9de8c7084d4c299e24e8deecbdaef7

SHA512
17e988f8cb2565dd7e955ee52dd0df19c3835243a52f14e831a1143678f2bdb738a3a8635693148a4b87b709a04152242c1f8a429af7aa24ac096dab07f65b36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b55cee064964b11b48ce987096cc8fb8

SHA1
a59b5ca891d4f056a72a287a3633eaae6a50aa98

SHA256
e22d34974b8b86e7daaea7a0e53011bfd1abadb6921255d9124c0539ccf4614f

SHA512
aefa143b5e1e88123f38288be6b654766e98a5252047af347e52805c3d3bbd623ad8fcb1606c30a07e2de7aad92621468499cdf3dfa828a1d9eb5b6fda8207be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c35c6bdfe3ed87e9a59cf10a847fbbd0

SHA1
a50fec2aa3be959a49c4679afcc3363e45cb0975

SHA256
31ad81b7654d9aa7d72fcaf7e44e1076bc574b08302ac876313b414a7dc50a0c

SHA512
9825bcc50542219d7e94725a3950203d6c161b8120c41ab98833e2c92d74270edeee6fd026664e62b712c58a78fed86b151f056ea5ab132446b163ddfccbbb85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab47AC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar47CF.tmp

Filesize
98KB

MD5
8cf9bca4ddd55a3d1adc7512efc26fa4

SHA1
78339a00d69655b5832b586481f7e749d864fc1b

SHA256
324b6dab46bf26177aad40dbd2676a8b7ee29620f8fe969fc27b9bf1a32838a0

SHA512
fb5e11406da73355e1e9fd8312e8a187d512de16799934925d4db9a2c5377bf45bd391f025654fd793024d892b417f3b930a0f3432e5e756d547174d8588801b

Download Submit