e93fc6eafa403a25247f5835a2f245c6fc58c62e0072ea1e30abe1865d368344

Analysis

max time kernel
119s
max time network
174s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ad92c769917199b039412e74a6af26c.html
Size

9KB
MD5

2ad92c769917199b039412e74a6af26c
SHA1

a56b62283b9b55a115ec9df6ce5453e17345b627
SHA256

e93fc6eafa403a25247f5835a2f245c6fc58c62e0072ea1e30abe1865d368344
SHA512

1cce693185aa89ef9cf647aafa4e16731af34513cbeff6f949475ffb2d28a2eff991e3b3b616e918c69a252bc4bdb5284beafaca9ba300c6bd1fa3322fd3cfe3
SSDEEP

96:uzVs+ux7xtLLY1k9o84d12ef7CSTUkGT/kd6pNQlVHcEZ7ru7f:csz7xtAYS/BONQPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000158b93e6646ec03103755841e961d6a080a592adc61239b7c1e11035899aa724000000000e8000000002000020000000e7e92e52722ff7d274770e130bcd10ac5670370613d80873d2be732bca834a4f2000000091df20782fa2e10904ee5e8e767e9c86f2dbe56ea51d832ab360305a3612fc6a400000007a6a2f2892c51713ae997d881c3f35ed517bc2c61b586351c6ff1ac8919500a93ea20384de9d3e73d858cb3eb73ded721532e49347d22f815798c19257d01c51	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4068FE11-ABF2-11EE-89BD-76B33C18F4CF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410638617"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70f55a1aff3fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000047c444ffb448445551db279ff7baeb4c45993f8ab4b3ad2a748c72330e0c62d5000000000e800000000200002000000096dd9dc3995c025925cdada32184240e69545b7f48be658609f0862a4a7358ab90000000dc150f3955fc0820a2a8919c8ac9750ae12d90155332dd1c07f130e412771ce811b2b1084996fc92651000444f18bbe7fec511b63b70d946160e5d5ac6ec1bb60090a6650b85d9c07eafdf6a2fae98d3b90cbe2c04758185022cedeec593682e9e4a27abbbff55fee4db8d95dc558e4e8497ed6535c0d5c44cd23e917af31d6511ce03858caddfcdf52fbdbf491fe3cc4000000085d5781cb3f8bbf315b11778fe95de25aa4984d09a9fde2e2797704e2ffa93dae595635aa263f9726efe88d567b5e132fe5a2fd2a6044d4c0be0ebcd83b51a77	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2688	iexplore.exe
2688	iexplore.exe
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2820	2688	iexplore.exe	28
PID 2688 wrote to memory of 2820	2688	iexplore.exe	28
PID 2688 wrote to memory of 2820	2688	iexplore.exe	28
PID 2688 wrote to memory of 2820	2688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ad92c769917199b039412e74a6af26c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efacc22b90f7fc8e90039122fb87cda1

SHA1
462bb7406859f51fe1ffcef5ff2f8b63f4fe2789

SHA256
071ec8a477c2d529c71130ef44f7c026b7149a905f0150fb26bf8b6f962f1e9d

SHA512
e3a3454349357410c9b35d427d268c4a8f33c638e855e3b6b5cb0f91f4067f6ca4dea670574ad3ae619f16bfdcd90b5cd97b0a4b1b9c0599422dddaa86225648

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7084623039441429c6a3ccd6ff2521b

SHA1
b3943d6a8ca1fc6a4d3b78bd70184d3edd860173

SHA256
382e69b1b9e867f8e509ef980f0401437c3b3336d9c604fb44a0c9ea5d3f233f

SHA512
276f2e00ee224558d64c6d61426c453a7b1520dd07310f299659a5495fe9c537fb5ca3a7345f094fafdb4238009c9e71b4d63d449f52bf38879e75a9827e0e13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c996ac7af7513b1f9c0386efd460de3e

SHA1
b042b17b5fa07df22d0e93ad5338c66883082206

SHA256
9f9810660170d193839630f12bf9408bbff3bde91f95220323769081b77cd5e9

SHA512
ec53a7dd3138b4af6239f6bf122d8f8cccaf17c3cab0dddce8abbc1810419714b2a99190a1d2b850f6d0e596aae28a7f11ade8d2d1248f63774126d3c581c54f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
712501d690f362bfd772b3a6986c4da6

SHA1
96ee614662c877fe6f97618b1e8fd97a28e16faf

SHA256
381c3423d72a0fa7e736e701dbd18bf009d73188c6d81d2eea5ec5ef94ef2de1

SHA512
38f66fdb5d5bf869e8bb6598213493d1144ecfe8578656956a846b2447a8a6a13f4e53fd2d62a75ada809c5f7cf4a2eeffcc315d164d0d01268340563ab0d0e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5334d4bf8c3f2615a7da2e1ce9421927

SHA1
ed3e71964ba2a039785a167072873f48ecef252e

SHA256
ba53ce8303cb8c4edb3e94f559f2fcc3853faf26041dc8cdb394c66f311acec1

SHA512
c433c09bbabfa03fa5643a28deb5d40e13304f543bccfb909fc3dafe329af0a656e33476ceaccd7d5cb2bc92b42f4d73074efedc44d704cea1b3eb4c33e6f483

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1396a590fb729179c690db0bc036457

SHA1
89fd2d56f64d98b2257e33b2217002e14333339f

SHA256
8487dfda97ac1bfd3ac894324a7f1a57276462840d223e03453fd0ec22c48581

SHA512
52ff133b839c022cd41c61e3eeb59b2d43afba3517cc53a765b2b0c59de6c6f27783dce10f2f4eb44081d0c3a1b81941268813ed6e7a08e298733e18c4ce4134

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a0643b24e9ebbd1e9e0152e2bb32ea3

SHA1
59fa9c81948996ea5af8be3b5d7b3206425d3103

SHA256
6c4454e694999b0c2dcae9c07627d082a3ab3a6b7ad77bc67da5c53d92351ba0

SHA512
749b977a56868ecdce5842741b73b3d8fe81a846b9567dd5b04cca9d56fe26220cc6e297bb4d1269715b2b55df6378b0d8d0841383baf4a894efe6907ea05a15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35874ee5715a4f4423b0e8303408385f

SHA1
0f87fd1d489fb37d76bdd6afc50ecba24f2e324a

SHA256
4d0dcf733394cf08c76e034bb174c9fdf47f5947b81eded27c58fb4b9f74e704

SHA512
64cd2305c7a7ad54a31d0d1b14164b8ce2f56abde21bcb90673040648bb5ef5b61c1135d774a9debbdfde3ad7e81521d2277f8bd06a2a788e19d743534792d1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd5c00678ce8a4e85f0d172e622f90d5

SHA1
215b9abe5d266a6ed59175aa90585da7dd90136e

SHA256
cb52c08b16db0ace943ca35e9580b85dc76cb58d32458a4dc7799c4c0145aa8d

SHA512
7ae776efee54ca3f6327969ea3970308bad6da729841ae3397c730e0f71c289546359e2d789b8f509d64a49b2cd3e02a635699ea7917c8a88ac81a739ab4e47e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29f442e16eff37b100b2893788bb4ddc

SHA1
88b910daf39159c4adb760049f5183c1e0dc1a93

SHA256
354cb36f32d45dd8bb9339cf22626ddabc32998728f542b3172c7251a513c1c4

SHA512
75ae76a265266336b5ec058c21284c90e6add3aa19d25ee149a05f4aa45297d574808a4e3ab0394f13f0efbb15a5e9a57f27735db3f6109935a01698aa407718

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65f3b388ef135b6eeb521c8a21a3e3f8

SHA1
35c52bd5879fc182067fb70078862bf83e0e5d22

SHA256
88180f77f75e6211636f886431aac99c0921f51c87c3b2ca33a0f88cbfa76610

SHA512
d097a8081e79ed5d611bb1afb4a692cb0106f0a6fc8bb6a9dfb568c367b38c07400e14e7e28c52b4b838b36def15e0dddbc01e996b8e2e8b929a65e589da0d96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
217157741733c3b2f197254572ed685a

SHA1
e2433d27559be4744154d1650c1acb3a758b0e27

SHA256
9c1e9839adf4cbe36a3f153c2a13777cbad836d805289eaf2c16fdb4e799620b

SHA512
9bf2de4e545b60a46dd54473a631da8b9b11f4cb3bdcf8337993ae7d68d4dca6a28b8b3ce5339b1a5a4aceb83dd81a3926518a44bcab793986a01ea7907804ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6925b0524e93b2d6eec699e857517dcb

SHA1
43851e6f9baa12022fe0ffce6a6b975a5722e073

SHA256
c4fd0ec7a03b0adfe98c630ab0741a930df681334afc61715943df094041b78d

SHA512
41c187a0fab2ba66eb93e1115e7d27f7573010c0e25d6ff3016a775dfa6168a6a3954aaa912512f348796546c95096ee119e9a0c0174cfc45365e7c29323890f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCAF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar151C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit