e5311cb850fd206f6362602c863417885056ab2cb405b90168413d2942563073

Analysis

max time kernel
160s
max time network
169s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

275128606bc9dde486ab4ad41a297cb5.html
Size

67KB
MD5

275128606bc9dde486ab4ad41a297cb5
SHA1

7f700066746da5fa5f1af234f49d7ae7310ded34
SHA256

e5311cb850fd206f6362602c863417885056ab2cb405b90168413d2942563073
SHA512

4f6adb533c1f3bf2aff7598e0c0de9eed1ef31e99f64c18221647cfc657f730c99006b8e0612fee789be26800f583f7df2d4b96b1a2e066356fc467221781243
SSDEEP

1536:IilPvYt8fYp8T00Y98HYI8tu9q/r1FTGAl/QE:IidyMo4xsYPR9kr1FTGA5Z

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F809DED1-A923-11EE-9673-F6BE0C79E4FA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410330127"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30131df1303dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000ed05bf42c15ce7ff7837f6e7c311f59e543e8ac93c85c41b3a75f2ef729f312b000000000e80000000020000200000007678880bab95ff6aa4d34f7a52c4117076ca071cc1f1edbe1ceb8d3e123ffe272000000072bcf38abedc25397cb115134efdcbb1faad913490500b94c87f8f17eb2d594f400000009b1e8537041367d36c684ad7374d92e1506b8854d35d2d29e7f84861af53769e5c5acf21b6af088af7630e7b2f9543e182f2fd7451b7b9fd32309d7abf065c16	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000e1aafc3e6cdd15ab3f6d71d637473976511197616b50b45311315bfcb59ab42c000000000e80000000020000200000008675b5c8560262576ddd6c71aeda1375fa391969f0f4cd6e6a05aca310f318a890000000fcfefc35c8f51eec78fa0a1c34ad817438de75d930cadcf7c08287b9fff52feb31229cca2ea42627aaf88ab8b1c23e59cb3c54e81df1d86c9145203672d73eca4794dfb0481423e39e53ebad9993940e4993274e7a1553d42c7792ebaa16a131c2d84b99b51b3ae6c11848e3894a76b56082536bddbfed8ef51b0f50fe029f040bc77724f3720090a194614439a0691b40000000403b731978c87166b799cb2c94fd1a963e9c733ada4ffd0560328cca9cbfb9cc4e61973e8bdcc7b7d9d718637aa334c8bced698bcc7dcc23d2678f70c529ec60	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2316	iexplore.exe
2316	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2744	2316	iexplore.exe	28
PID 2316 wrote to memory of 2744	2316	iexplore.exe	28
PID 2316 wrote to memory of 2744	2316	iexplore.exe	28
PID 2316 wrote to memory of 2744	2316	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\275128606bc9dde486ab4ad41a297cb5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2df08f6862b9b2bd39d3e541fda67ed3

SHA1
392a2797d4e9a8c177b9924da9ac065c4f41b7f9

SHA256
876da2c9434809c7db0bff5cf3dad9ddec2b2b6f589e982ef6feb9a1cd3d314b

SHA512
9dce43e4d2451b4fffcbb2dabf02516a1ab4c7dec8f9602793a48b4162832d060107516f2484cf1155e98bf33a7e2d38be945a7e5a4a4191f66f51b9a5d24abd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8976fd5134c34e468896621f4f5470b

SHA1
335eba234446c954fcd9e0161047a94f5ce48cf1

SHA256
9bfe6d44115c9d67197a3e70c76d4e8e5288a3b38fb3d98eb0c3c5eee3c5b43d

SHA512
e0e7733b59e27d5e6b89bd8c54e9e156dff8344e078524e853ad8cf920da621d40276b7888716bf3ddcca8a6958dfae6adbb38ba2ac7c99be870f0c79192169a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f27474a8fbeb9daa0ce7eab74b34c73

SHA1
d347e126b72b92ade0ef90d9d1448bc5ab3b38c8

SHA256
a556224aa4bb4ee3e848120c0ac78ffed6a6dd03574eda57005e15b69c429141

SHA512
43495799d5d581de9769915f8b52b6737304faaee573a4ae74fd62352011c4f76dca577db120cbdcc8b6b41d21ab41a025583866471c94aeb34698e1b2f64d86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee2b8c152076291a1ba29588de714de4

SHA1
99479212155ad956b003c1ee0278c9233edc47a6

SHA256
e633fd7bac583285ce2ce1fc5cafb0cfbc029a98f90ce380c98f98cd001fad9c

SHA512
fb004f19a6b0f5ebc85316b229fb8b190633f838d4cc19bdc249e4e240488524e6096f283f5098bb2979363bcda951e0c33e58e532cbf73760d04940ffe74de4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7aefa11530cf3f281f6952fe0b210bb5

SHA1
0a8a904da78df03b83302789e29a0e5e4cc0c7ee

SHA256
46516deb9c4f77b16daa6f64cbe716ee1388b06a9d6c4291e10819ac8a8a0516

SHA512
7f1d62f170a956f47823f7e0cdd0f4b747039127e60d34478f6a1187cef2b10380adf5df10c951f045077aec1a15b1146dbc365144422c5581f6eaa4a3e9433c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50ae20edb937fa7a16fc7925a667ce19

SHA1
10c0a4eb12b51bc5ce64e45bcb21bec1825c53a2

SHA256
a650becd8b1d13f1f9ffb228c0a8dfb5ff4ee3c0e192fc60c7213a049dee93f7

SHA512
9be28b9a75acdf4b58d26710863407aa69795769758f481c0fd5565f8ad829d70606c3b050a72cae573711d3e0d018e68a511a2a605e1ca5c387fcc329b2a18e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f76e44457000b2938d0e12748902f412

SHA1
7c1568c1ce694445d64cae37b5661dcdc24f5692

SHA256
e8139ed30038df5d795ec0ecc2d542dfb989165dc2f677763b0524fea88ac1f1

SHA512
c4c852161f51922b9beea647d8cd8b0865e6b414d8cffa661f5d78732e3080e92343799bf7a3d81bf189371527ee3747c96b951cf4857c52e1f7f1497dd36cb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae405fdbb7982333f90e7b02b4035a18

SHA1
dd1959f0eabadae0894d824d18366486193bd9f3

SHA256
7d236aac9546ddd07bed521de8bf5777df69909e9ef75988ccd71faafb9fcc45

SHA512
e7d595616528859b33bf17e996335cdfe9b295aa16643600825945ed3a4a74049811f61a458f568b503bb5029b3af871137c602834a43e14d7d0dec3b164a0a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fa426a29ec2bd29073f79e009db4bf8

SHA1
1c5714556701de29f0792d32f7f49d2f3877032e

SHA256
1a29a803ef24363d3bad5085262971b756f7aa40ee04c25fd358a71559b5d306

SHA512
79e501c152b3c2ab2f5133736dfeec8ae83d6ee9cdca305d53ad480b084dfda564af463ca34a021d088ca994a1b0b237f4884f97e50fa2b82c1de716d776b6cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
682b11d2f7164907fddfdd3ee36b99d2

SHA1
1b41064aa91a06c50e785358d2a46a1e160bb8b3

SHA256
59bd22d0123bc96f1f0526310763c898521be9e687455f32817c7afcf2d18497

SHA512
0fb3554baf0025ad73047d1b7c1cd1992031f0c8d722c5bbebaf3b37c781da3d32ee51fa32a98c9fc79b431c72fc6177b52e78d43eb95952a4cfa9e752e317d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69036262351e37ebb3f9452b5bd3d3b2

SHA1
8687b55d78c1fffb92642b92f818470aadf27ee1

SHA256
88a216f75dbb27d746bb39ee92d58f5bd1a3fb9b5da23a56a9f2144407eeacd6

SHA512
0ddd5172645fa961a2f5fdd1e110c849e172c4a1c1c9eff8cd7fa1313f968b843ccfee997918cfabf1966e8758b5c37d5c7e4256c592ae1ed84d1445437478f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fc4de0fc0501fe1f1a502faefe154fd

SHA1
b690d7bda9f791ce62a60ac9c5e17ed148c58dd4

SHA256
0cf0171cb27f32e69a4f2ed4d1e713667d0a0177551ca7ebc933be602580c51d

SHA512
5750b031b8cc051cc34a83521ccd48a7c7af1b66dbd228271b9ee37e5ef910de6e6c7b7a90937c62a2a6bc3cdfda6298d9450b691c043f793ea73520e9dc5fd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB3E6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB3E9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit