e390b930620b24a2037916bee900d5a4b9dd2349ab7c1952fe0a8cb26d8649d3

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

29447422e803570559906ab453aa0728.html
Size

43KB
MD5

29447422e803570559906ab453aa0728
SHA1

84197f0c7febb48382d32268cef2552a1181a0ac
SHA256

e390b930620b24a2037916bee900d5a4b9dd2349ab7c1952fe0a8cb26d8649d3
SHA512

c97834877bd977178fe4bfddedc96f0f6975b67eeef96d5fbbc2eabfc2fa1f85ab2ec67949149bfcfbd960f89494468379bec686731454248bcb1b6a92fee680
SSDEEP

768:JwTdcqpX/pJdgzgK3ncmYI90yt67k9S2yWUVaNtH:JwTdcqpvNgzgK3ncmYI90yt6HPF+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000010495832939026c3c9c37249f706815f59fe148d4148bd1ca608f11beb22cb2c000000000e80000000020000200000006b734742b8931aaef25cbdea23b92e7a20c2a6704292fcf2928a4c4be1059c2a900000009aa35d4bcd22fa016ed83e1b6e238282373383026796647b4e06eb56683912294632a509af048b720b840a99ae8650c20b1696b63861953306f6cc0eab6f069ddd986017c0054e0067109ee69d8b01c00a876158e401c7693148a6e41c994359c9d1e019679390d1a4484f119caea08f4d4939aade2504182805ea7f9d87cbee474ba95add0cf9f141dc39fb542688f4400000006be6ab4c6728625461798719752526794b49bdd2d3d015419aae4a751317eafd344505f36ea06fc8bb22308479c1ce2ecaeff0e574e6471dc037f6164e7df234	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410340427"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E8B29B81-A93B-11EE-9240-46FAA8558A22} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000004e691410c02e0249f7c4dafe6535704734e72f96af61020e7c01ade604670e0000000000e80000000020000200000000d7b765832dcf8ef425d16a882717a56f2bb1db317197456824b3f9e205ef58420000000599196e521a393e4ce6ec48734759be971c0a14cb48e29e212200ad70da6dd1340000000506e689d114b3d726eaf669a06d897081971d841843566283fb2682e12c47e39f1347ff30727772ed8296b9a0b7fd290dbe0c1437b27c25e80c9697e9707bc07	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3072b1db483dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2360	1984	iexplore.exe	28
PID 1984 wrote to memory of 2360	1984	iexplore.exe	28
PID 1984 wrote to memory of 2360	1984	iexplore.exe	28
PID 1984 wrote to memory of 2360	1984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29447422e803570559906ab453aa0728.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bbb66770c0f2c5f9667c2edbf08559a

SHA1
bef59660b1718b191f0ac3cb118aa0e0189ef488

SHA256
1f5a9e3fe8f71a1dfafc390f487adc7a0f3e0d0dbb7fc1ccfb94ca65d3ead94c

SHA512
6aebf58078e1451fad15329443c4f3df973cf2567a68ef36cda9e5bbac863c4be8780479c2872b58d0fae0f116771ba3e0534f6320fa1b48c3bd50d9a3853762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8b7148e024ec357c291f17f2c716c93

SHA1
107e50699daa1143f4fce0886675ee04454569e7

SHA256
b1a098fb4665d04503ec0e8711d49e6b46553f3762846e812325677f322d8ea8

SHA512
d83286dcd404ad69afd82e1e69342c7e58d2af6810fe2e48f8d42f52be9573d271820326645a5f3c3c48c22d86f012a3de1257d6efc501e999ce3a451707f5f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
380843e9ba1a3d23ddb97c916c646f5a

SHA1
14d2a71cd0bdb35a6ab7ade24ec61cbd2686fb0f

SHA256
642703e49ce7e65f92d3735b92dfd9e9dfce5c23769e1bd3e82dff1c6a17f77b

SHA512
2cfde90a50bacbdd7ff3f7362e078a030468cae47e957bd2fc5ab3453537edd4de26404280603d5f2e33f0fcb4a5b5ae34a611cdbf69b7d81f2669af838e2fd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d33f94a6b8f1ee32670074c363b25bd

SHA1
d814086d13fe99988ce802985c0f9f6e002ceb29

SHA256
a369c3b0f99d45df0f97d0bd680dc20fb317cb9cb5296a635e2c723e2f05e974

SHA512
f7bfce59c5fcec2287863d682d31b110aba680600799f862a3903ac1c5e3cb66c39d9a3edd13d8b4e1e266d31c93fd01da0b90830b256cfde828a5d736927689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
783ed284f3b0ccc00908359f96ab22fe

SHA1
9caf3c181b3f7df0d0958627bd91f1e4b004afb3

SHA256
07a1be4527363a873ab165da80ebc931fd47f6d22355345e5cacf5cfd197c185

SHA512
5e9f179662df2e13369e0f857fec6aa8957ce2ac6db7b634a8a3f4b837546ef82847051bc9a6e9f47847efbf33e3ef8aa8b787fbeec7e991ce5187738f30558c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eecfdb6234ce57140a60bf2b09984bad

SHA1
8ed871f5456ef3553a9ccab5131120a3d615a732

SHA256
f14b932fd4742b7a045469abe958d2ead189eee8d65320bc6f063b26fe4b36d4

SHA512
0cbdfe82d79732c06c8aea7b8d383adfebb107ed16c8b138d04cccfa8ca4acec148144466cc909e66b8671a33a3592a9d98faebadae6d57a0c66748af05a47f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1af7a915c958c62b27422108b7ae0f97

SHA1
ad943cfd97043993b43a29979895969a21ab6722

SHA256
c904b984710ce6b1b145519f0730ded6750cf42a3ae2935ae14e15161459aa0b

SHA512
ca1756707e0129fd8641bbe4408bf91dd0da7cbc042368d321edc5ca3a5bcf0a47dd81b172a419b9efa7e5ad466cdaaf33a63a207ae8b29c03fc1c93e1c257f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c4facbfaddcd58896f0852d06653de3

SHA1
67dfb3c1fbe3adb1b9d85f5539788017b1fed847

SHA256
36ac44daee1fcf4b0aceb98eac191d3e7c5c9c0135096ca9bbed2f0dfab98385

SHA512
9d83f39cac2622e9ce66b660f721dee54156e213bca0817e1159041c563bac5436269a20cd4c9039d31fef97fbf2d3b82fc90e8dfdba15a97e717705b304ed15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32d8849c527d1740735e10d228b6d3fa

SHA1
72df6c2ee62531bf44b996c3be32ed622aac47f6

SHA256
a6967b05d04020aa52d07503c5eb3c9e251dc6657965a52d370e1f756da969b9

SHA512
396c70ce176034022db99e69d7cfbdfa4367fe5fe60f617dfd977f9ae35118ef1fb3b58987dd2d29bd9dbe18dbf5d418f6ec6cdfd522896b53dc3ff0df2f3a14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d6c3f583802db4aca39f96348e52796

SHA1
d3c07c12be3a5b3d3451294f98ac62bfcda46a95

SHA256
2b7bedea5cc153ab2c898346ad38aadffdd20d33662749e6fd765a3755b7a623

SHA512
95f134e1c094805740325aabc24dc70bc163230e0854c3d2706cf68bfbaaaf2af2e3cb2d5307ebf2fcfd350b77f6850c804eede446465b01ccb59b4c7e4343b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34a204e89ce7f1c435872a4f6057d4e9

SHA1
61c7e5e3642ee90d1c2002972c828cfb67a40bcb

SHA256
e3b6b1b6aed60237851ae055c968cf047fb81d2987eece69be13fec94ef7c264

SHA512
72dba7e018c1c86843b9e8c913cfc72cf91c9703d34b8300e2359ae838c1fc55977f61d23ed15175c0c0d9fdb73eb5b2693972498fedd9376f70be6168a1f9e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5778.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar577A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit