e28ec3a1eae04ed0c5d0b4b240052668332ea6c31a16bdeb3fefacbe39387458

Analysis

max time kernel
142s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2aad1488e8ff46d2a882077995c0f586.html
Size

7KB
MD5

2aad1488e8ff46d2a882077995c0f586
SHA1

418e036d90b4ef2125842b48dfbc5bde72f21987
SHA256

e28ec3a1eae04ed0c5d0b4b240052668332ea6c31a16bdeb3fefacbe39387458
SHA512

5d23258c6c98071f2700a1d0bbc60ece11ff4bc48a8ffed3367b3d6b4483bb9229e57739c6dc18f28cff4ef22b83100a0b9c6c86f06e2ef876089b702d8e48a7
SSDEEP

96:uzVs+ux7U8LLY1k9o84d12ef7CSTUazMcEZ7ru7f:csz7U8AYS/8b76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000854611cfacc029b5dc9cb0491dc7e8bb47eb4644be40d72aebae82b40d424576000000000e80000000020000200000008b17e152b4f6fa36aa26c6e40560d253dc462496d73f325e81ce4223db425a9f90000000400ee7a896f48c870e14274c463b1fe5427a438af0c5393f231bc43ce846378edc206d21e8a69067d7cd5768750e0d35aeda0edc294057a13f3eea98f9c93b17aac30ea551cb3db1ee8a9e06138e66e8fb3c75d11efda7a4a3f3cb3eac229e0f31d0d5e68ebcd44187f4ccea818eaa819b7a61b8962741a9a6e83be73b24bc4dd0ebd7b1ed69115332f71c0f463f6430400000000db514ecbfba524e606a34f37a214ad8d5099cf11e8a1c1cf8a634ef12e360789261ce6f3d9eda14eecbadcabb169e94061fe669e684317678f757c6c8298fce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000969151219e3c8de883b13e909d3c6cef3e9f2e7343219db96b86dfa09a345235000000000e8000000002000020000000a3f143f13f248f5fc28147fce667924945c7bddcd5de65ea15a997d02e9540fc20000000afbf0601e6dfefff5b2ef936f0fc641a5d97a2590b3a6e6c5f14850c14df6e5b40000000703adfc3dab4cfdc400f9b4bb4f9c7f9066a1a88c74925502d4fba8f4ee3d2efec776bf392b0ee94af529d45736ac288f616dafafd43cf929590f5eaa06de243	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410348284"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b3ff185b3dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42A9E5F1-A94E-11EE-9853-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
1212	IEXPLORE.EXE
1212	IEXPLORE.EXE
1212	IEXPLORE.EXE
1212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 1212	3032	iexplore.exe	28
PID 3032 wrote to memory of 1212	3032	iexplore.exe	28
PID 3032 wrote to memory of 1212	3032	iexplore.exe	28
PID 3032 wrote to memory of 1212	3032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2aad1488e8ff46d2a882077995c0f586.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20091ab67aa4ee1bba9c1d17248be847

SHA1
de87daffe69bcb7f229b8dfdea1699d60e4c26d0

SHA256
1a756674b54b584cc9607cf5493c317c1b702d1b93986a159190655abdfeebe6

SHA512
1e85d40cf011daa127400aeb4fc8be632932ebfdaf54fed671bd651bc5ac14b1701d5f05a4f345bb6f4ddf875653ecf31bbebaad0d4060ffda1ef88a19a292e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec5827b7b5f8a658b00fd62a2dea755a

SHA1
19a1f2da864924be76cb5c4058d6a2227fae0b09

SHA256
d5c28b736b1a91ea9d5776bd5a58a22aa8f24f9176df0b22b1bdca88fde1f03f

SHA512
b21293404a4498223ab5582901d6ff0512c39cfef86446d47812d820b420775931a507cbc0b1d3852114c59332f05a602ab795249c5fa775146510309afbfecd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bbe3e18f8759fe2bb326bc739020807

SHA1
3647eed33e41b553fecf90f412574f5037d9a834

SHA256
1f89bf403cf2c035262534622ae887f05ccd95e64bda72d3fb0ef66e8e3c9cb0

SHA512
822ccbdde57f7e4c8747e36a4a682701cdfddf39a8262d674a065b5fb8f391489b863f1733a95168f8580c019a155cf85a76bdafcf3468ebf0183e65a7109906

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d8feab48a94ce6be595d8824bb4f310

SHA1
c956e34be23e80505c7bc8df64bc6520c9c1a6ad

SHA256
f40a6209f5ffc968e8a95c8095a2a51b1264da7c809a4f2369c909eea4ef3494

SHA512
d71c0a0afa7e30a7dd3ec9e4a7246cda55a9d4245bfd163509c0dd312232fc678377f838774e05e2ebe466156ea22a4d2d26314ef60c93e74757b8120314de33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97450afa1579899843620cf2f37a7e56

SHA1
8f124b9d588601bbdaa2e94bc559c3c2aabab0f6

SHA256
198913e48e7696cc309eb4f6fd0fc149cdb611f4a4da8d90bbc7683f47ba37ae

SHA512
cd5ef01b09104478939334f0e156de038541473127e42efb4ae5190795b6c6a0998d4256cd4cc8efbf1e3fad6611b0cd34095b52ad1ae9b0f194b1d9fc326fc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c38e2a9cc02993aee4f2983afb1fc620

SHA1
58708f3ad45b6dc02e615ae6aed2186a3dbb1488

SHA256
7346d40827f3fa7ed532a8d5c0f6b15ad5f1abec451f79c0d50e02e8df8d8724

SHA512
b74b6eca9cb2bf495a7d8304b35b035308f65216e449dfcd8f1912e92a7de04a4ff06bca00847c02b3b73f083dd18035031f3cc368d9427a5f3b7970d0ce0d1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c14a766ec60a0cee89d574c88cacb0d9

SHA1
6c229fa9b2b9a4c5bb6cab1e806cdae02f26704e

SHA256
b15d8b346c05dff6787cebbb8b23a6687a7ea9cf6464faa13e6c1457a2aa636e

SHA512
b1f5a63bc6bcc3cf6f33b4832fcc7d5345f4d09b33608c14055ea2f4eaa4a3de790ee7be8814a02e8305381f5aa2c55c82307681bfbba59a139dac4ad7c53f06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77f18e3e0d68f3544120354229868026

SHA1
5f71bd814724ac8d9bb5473f7b866b9a058a88e0

SHA256
5e40f2a2438bef3c10866fb898a15aa54441322a7df0c2cd641eb95776aded5c

SHA512
fb9095b82b819768963cbfab4639e47316f454af5eadc5677a6dc565e4c0a5fdc9b720931ab913e05b8d653bf200336ecf357e6ed6631d3491c30849fcaad7e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93e1a33be6189b5b1ece7a9e7815299b

SHA1
6a13849c5388fb9c91f7a9896a699eabf127c3de

SHA256
a5a47f968fb1ec3d0d3247afedb2ab0a3df7fec06296d1c288d4ca9dc5127c2d

SHA512
799542dfdea8b367f8d469f58928b74e265541a5f99a95b40f281989534e4169a8f04a949a5a702d1ecad458670e7d6c0a642dd4cacd479fcf2de39e98d47202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10fcf7a216e5d13a10997087af091488

SHA1
01f06fd9a5937e0cbb8289245af426e52a4838b0

SHA256
205b959a1503ba3d03fc71afd915a57dee512bc1162442d234592fd9917aa8ef

SHA512
a38120e3dbcac5f5e8ed9c7c3538fcf05d4fa1666353a86523431e7b513c8891343b87a39913e70d90baea03f78c4b40e2265021a98fd0e3eb9f2fade2a443fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
128e59f801ad5b030998c5826293ceb3

SHA1
c543e9fd1cb7b5483c70e41fcbe79da4af83583f

SHA256
2c0f0bb3e86c33357bbb4c4a81c538df19b05e065fe93edcd4e4890468ceb734

SHA512
5655ec141aa541c9b3f9c0bf03ca0509ac2de35cc2678fdccb8af861eaa0751cc982f3aec7715e920ef446e89491115e97865d2b59e553f00bb1646018ba7f6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB36A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4F3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit