e8135fa43e058427ba74fbd40429c873eb6e22345142dd0b1edea26a303a9e5a

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b60f9598d1db8b0225283a3022c500f.html
Size

53KB
MD5

2b60f9598d1db8b0225283a3022c500f
SHA1

a05809ec8338345dfca4527bf7aa012b8c120488
SHA256

e8135fa43e058427ba74fbd40429c873eb6e22345142dd0b1edea26a303a9e5a
SHA512

77baabe2d981c6295505474bb7b6035a278e1bedc8e14443570da039f9ecd26f5e02e801fc8e78177d0008ceeb0bb25dd21d46f8840a8e65f6c1c2e1f6025065
SSDEEP

1536:9kgUiIakTqGivi+PyUsrunlY863Nj+q5VyvR0w2AzTICbbGo5/t9M/dNwIUTDmDm:9kgUiIakTqGivi+PyUsrunlY863Nj+q0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000823a487d35cfd73c37329aac723790a792463388e97653eaf2c73aa4222d03ac000000000e8000000002000020000000cdf90f7dd65f2af25919a5648dedd7cb28c3bb837421d7f62635567c81ee9574200000003d43250d1460069718d86267fcc7159ac5744e02aefd295a326a2a20ff9a74d84000000047806c1d33d6e505ef16851099437f9be4f95b1daa8e74d853a53f783e236ce09daa450aaa18f888f12624886a7138b23a5615fc1bf1d1c68c942f55e9997dad	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 208be744643dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410352190"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56EFB131-A957-11EE-9317-F2B23B8A8DD7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000004a6eec437789bd962adf2db2c4fdfa447b83c39cf833d4c5a94d7e550b26f144000000000e8000000002000020000000360388a470adb3c3de86e7b4abc317394ec1eaea9eafb4e12f377f48cfc79c51900000008eed8c629ed0bdce0c7ebdaafc01f5fec1bfd4b0cba238a1956c60e059dd8c84b154b666a72a6e4f7d0da9d7bbb2e9889c42127ce4b6a59312d30774caaf9489d289986ec77c2a2a3f97f6720ac19fd33a98ed942b54babb35ed27dfb885485624176d638b68a4ef2fcf02411072d41883df64253c0490c8368fa490bc683ce30969633af6d9750344b908b9afc7b20a40000000658a051ef7b8253a4a5b768ec1c4861b4e41a44fb28ae35bd476e4fa9973aad515f6b4f89699b1cec437bac34c58d34a19511a33970f424f2050b4a379ed8d10	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2056	iexplore.exe
2056	iexplore.exe
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 1408	2056	iexplore.exe	28
PID 2056 wrote to memory of 1408	2056	iexplore.exe	28
PID 2056 wrote to memory of 1408	2056	iexplore.exe	28
PID 2056 wrote to memory of 1408	2056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b60f9598d1db8b0225283a3022c500f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abbf4f3215f6f263f5898d239387f098

SHA1
7324b0e0ca79ffc87ba3f88cd71c019b60d77968

SHA256
6705ebcf57258ee62bf67b47f0a3458d5e13d74b2c391893461de1aa4cdbd92c

SHA512
64a202d9e91c24385de5ca07aadf117e84607c69caf3b2a6fb811acb0fdcf94cd39c6f7fa4b799362bd7eb1ec973cd76d5fdca51c74549f8919d2bcc54bdb3e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d9aeddb950c939dfd7188d147e20c1d

SHA1
094058e1a91c6a3687ab8bd03275416269dd92f1

SHA256
8829df9791d4cc678ee57394c15a9637540fd9cc69770cc5847d7940d4dbe6b4

SHA512
4d03d5d85e5a711162be6de6fb207533465abe7b3467a6a778eaa122bf399a111b8387c4aff27fc0ad893a785acfbc455547387bea0b35bf4b3a7cf7a79ca027

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b933cf02f94e06ce671dbddba58e2e16

SHA1
e61dc6d227c1ffe8f4fb4587b29f84633ec26fd3

SHA256
1dd16c7c7dd0ca39ca1ec4007e42a525cbf59feb8ef1526005c8ed53e16e4ce3

SHA512
acd69a19608e7cc0b979adadcff4c352d0eb09408b89f4b6a3b8df2f8b470aa7f6e94267779825eb3c4884f0d89e2241eef38abbdc3907d20d504f149a7b1018

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f81cbfa77439a12b86b2d2dbc98f628

SHA1
09f0d726309e2ba5484c42e665d61a154003b7c2

SHA256
192bf7e346fcaf220989ad4c5bfc604e1ba8fd84bfc6ab87b69d4ca771424aa4

SHA512
28db33880a61086d0a7da8c0ee40e30d7960698904808c78298a3cbd7f3f219e1091ef3e7bc1defe65445c871ab8d17db7110aadf5a6ebcaee4dcb96ff0c12c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2e1b8feeb14986c3f35807d050ff6c3

SHA1
9842faff8946a654e5a05634ba83f614eadbd59e

SHA256
511ab8227079a1987d346337c8f960217f4d22869921257d616b0b7490641750

SHA512
58b16b0d9bd2fdc4d08fa43f2645cf8997df2ce88350c31a97773649302110934bfdc56e595f7319298e14b4e7f9e1957871fd536d02f3d26548ac62eb3eaca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffbb2522a140b205a3ee07d291916086

SHA1
0e42a8d27c868eeadfca2034f59b3bb48d2ca990

SHA256
dee55366a33b6172f2f332755544d7c9edf156742ccb43974781c52cf24643b1

SHA512
b27326b876cb64b77331e8a0666adb018aa985c8827b9fabcbb13ecaa3be6c0d2a731a4d5f0be2842386c1131128261d545ed62336ea172dbcb4a436fccaf897

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3b740202e742f0aee15c5ef979c75cd

SHA1
3e4a06d18e0b10d5420d7c732d9ccc41d6cb4132

SHA256
673e4af2e4405c8e22944a3eac63de26ce5f7b0e12d7eff691f4b868a43841bd

SHA512
92fc4afc79c5c1083287fa2f75fb4eed6d5c618c42f7489612c0234dd0c7f2b8195afe14a4e4fe9ba27fb7267b62a58e064e4c86f587584ece634c291e9c6072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16b231374f7ee40d229c527c4f03e4f3

SHA1
4edbe6d485d643eb534cb95142290d6d541853f9

SHA256
dcd87a17d98ef33009dd91ddb3528cc290fd7bee14668e07bc96e57ac0683044

SHA512
2640e26462566432262b22d907edb4a47eecd4f1bca75203420b69e73f00ec57eea8262ee8e0e33e9257e4b89a77a843d839d6d66606cb4f530680fe67770992

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3519b0ca315a6bf161cf2188582d2678

SHA1
d8cd94e0f0dfd91fb86d49a0802a6ee2fa6c79dd

SHA256
9d3817c8e63723fa61db3d9f6e378be24264bdc5670fcf47001c78edfb594cf2

SHA512
b24ba30f4a6e25ea6385a2c6ce96bda65b882957912103dec70a78da447d4e5fcf1eaad97591c0fcca77e4610dfecdd932f7f83897b2c387a5c2574d0d9b284b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bff4c3765b75f6cf3084bb877ec7c0f

SHA1
e74c25ffdd96e5b3fb3b4e6f8acd3771bc68cf19

SHA256
9fb8864b791bb88c6de8e3acff9893be611b4d85250ec7c7bbeb2f4e215d3c1b

SHA512
c2404310727c6efb1904a2d9a99957fcb68d9fd805f0cc211886747f51b64b5ead804812be7282f80deb302b654f49f2df7a21d301efc5b8c5f3122ffe470038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d513c57503d32ed86deac6a6f886bfa0

SHA1
67955d7c195f31bc55a4e53ddbbe9847fdf1ccb4

SHA256
dac7093d4a415e942f036246a5a00fa6bb6952713a6f9513fdb927e786df7464

SHA512
effaf805d827429f223316bb46e91dd2fc0f108b2ca159ba969e7da62d78a1126042d9745472b2343efd3ba6c5d891c58b633f382df956cec3f01a0c9adae48d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4cafd9b8de8741859da4cdeae771dbf

SHA1
8a8b097dbdc46f7a31ec922406cdee75bd112401

SHA256
4143aa36e193d82b7ba0591c9e4696ab93815bd01ba4d00250b18a7278704fc0

SHA512
cde07096b9b742a76227313a052185faac32540eae3bc12d9cf37acb46dc872f54d9cc59e73b764d8c7493a6ae1117a79583f4cbbe7d4923c2146a2c77fa7962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa2f263765b05c9938da9391e9b5a49b

SHA1
d8e4162a67c3942f9f9cf5702c73326992b210ad

SHA256
b23a2601409d6904ba510219dc79be338a018c0d6c03cf350c8e8ab685df198c

SHA512
11a42b98d0e10ff58d079eeed557aaf43df454d4ea61fcf265c78d5b06c8de7f9cf8fdcbbb4851027d11f156c159735f7fa6d0cb20d6e8b0bc09080a4ea35d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\normal_post[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab261A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar263C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit