e68ea032bdb280d7aad251c2dbac866dde88eee59e582cb2ce283cdf15e25d62

Analysis

max time kernel
145s
max time network
157s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c195c4851d275205597f5ebafba891a.html
Size

53KB
MD5

2c195c4851d275205597f5ebafba891a
SHA1

7aaeb522ed4ecbfdcd5c4d26b334a1fa88ade9e2
SHA256

e68ea032bdb280d7aad251c2dbac866dde88eee59e582cb2ce283cdf15e25d62
SHA512

97ca690d213db052cd1ab3efbb58044ad5123b6c10ebadd9a83dc8408debb82caaa89e0334c523b3e764f919812d13b94c831fb66b055f75686ea6dc563f8d53
SSDEEP

1536:CkgUiIakTqGivi+PyUBrunlYkM63Nj+q5VyvR0w2AzTICbbooFo/t9M/dNwIUTDz:CkgUiIakTqGivi+PyUBrunlYkM63Nj+w

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{569B2471-AC05-11EE-9317-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000062204fd0469a8acee3ecb31686db358b697f94fca10f3a70feb4a564ae6a2f59000000000e800000000200002000000060c4ad094315184df4aa815aa91c7609976bc5f931a77dbf75142f33259a3ae390000000fb223d96bb17875a5c97c2de673fd937535f65477f62df0ab4e4e46663e0b92211ca35de491f863fa7ad6f0d6b149a701d8d375593683566cf98d37c9315a32374d9f7c7996962dd4e6235889c2800780b7ea792e979a32cb0eee8eef5214a6eef19afc8c39c39e591d1875a48ff03afb95d57fbeb639a9b9bae8b2f23622c16ce38266b7e2ac074b480ad1cd7e699d9400000009c7e935276bad6930d49b6ac58d408e4c681069aa702a000173741d52f5acb5dee3e362d663d2657f339bcc27f51c7295339ded1e129d9551c22216e0a73ebab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410646819"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c179441240da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000add3cc1b5247f73ce3fba38eff9d5a0f10e0e040ae7ac035d12a636dfb2a0da1000000000e8000000002000020000000f870b48a193658555336bf28b2dbb5ea30ad239374b4593657c02f4428222dce20000000075ccbc8eb93ce294c42081c18e68d93e1b7fad84c9413ceab49af2046ff651c4000000091c2d56f7b6275a37f21106bb056422ff923bbd691c5b3ce0bc2564c025b28ced33a3b76f0bcfe66975f8e071c569ab4c71cdd7f16528eade159546816e18053	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2356	iexplore.exe
2356	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2696	2356	iexplore.exe	18
PID 2356 wrote to memory of 2696	2356	iexplore.exe	18
PID 2356 wrote to memory of 2696	2356	iexplore.exe	18
PID 2356 wrote to memory of 2696	2356	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c195c4851d275205597f5ebafba891a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb9ec18506ba69dabebb79880a93f98e

SHA1
f3376a2238a37bc4dd0c76024ecda4161a548bd4

SHA256
89d02222874df6737a1ad9b993693756c3a8ba622beba94536ce187a9d7bb942

SHA512
f1da9bf6b3e4ddd6f03d7c342b097c3906dcfcda8944eee924c9349ad6f51773789d983310f803e4e27b97d9398ebe234dafd18cda15cbb17a027d3c6136ad1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a95136e7dae7bfe8e4adc24738390ca

SHA1
806f89e30d1c5e7f92a0e6bac67a5dde512cbc98

SHA256
1a9d1451fbe526bd4429768356642d3fde17e14fe77d097460342571f8ae1887

SHA512
f3b67270bd44da68d74967415cb2e17a8053e7ffadda81f805f839585aa21995b8086514adbeb2296197068c4da148ced25e759d622d9343f3928c88a943bfcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e65c030fcf95346de740c1d8a240982d

SHA1
4860011a32bbef81dd2ee28b871bf13840f5a8d5

SHA256
45c22ba037573bfd4642387908ef9ada4b2eed6c0d4798b91661f7e81c817bf2

SHA512
d530a7f8849368fc88bbbf93f99176e9bd7720145be74b6778b002520bddef2bae8dfc0c27cdddc88580b4f0d0c49f9fddb2457ef9434265a8d9e6714c13b3e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
652201e9fa4a2af957cf21f025f08fe5

SHA1
70d6ef74665aa96b26e6779957645d1d2a7175db

SHA256
0c815a89e318cebde3980b4d23652dd6e4dc4dff4e9318271780d5f92f78cba8

SHA512
b1a52e8f2e0bfcb3a9f4e8362fe78ed67ea92ce4990c91b7b8ac1bd3c54b505470cb1cd4d12aacaf6aa520ff396ee7db7642b6b5267497efe2ca8e7cf648c6d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd3d7cd3d3c288df31bcbeee51454fb7

SHA1
caf9d083aaadce86d2e88defaa4d2198f90c946e

SHA256
e68326b9138fa75af771f505a9518924e93178f7811723ffe7beb0d4b22c5a3f

SHA512
493db9d0442d586376004a1426d9b640a437866a5637021163b686e178107ad3a71e14ada5708ee4e17c7baa404c4263e4209a1fa7942ade63fced49c45567fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1167e8c7925fddd06f7f8b629be0bed8

SHA1
80e911a3810301b6387ffee51e8a0ff7f147dfea

SHA256
d07aa02b22a4560940d691f51a02657d1a17a28a653148ac962c05830eca9e21

SHA512
533dd54a56e16e0baf7d00fdd8bcb8b35cd57bb390d0cf45149dde2c1570034c1b21b814125324b6be645e9c9fe949c1ee14bc1622edbe33190b6401578d56b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89bd7e65131a14eda208a9b564549a89

SHA1
a8466487f33d28ba0d9aad9af66a393e27f7611d

SHA256
623e4c8d59c002c4fb383e2ad1d6a2d51130ba9447ad8a3f3a85647432492920

SHA512
e78d6de76745a9b9526d11dbb642a39f9b19651b24a4f48a84ed7a9e0397e36712f4ee709092dcff769e300f77b8f04a4b7dd1a5bd019857b787ae1ec0db74c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f98a8ffa4177e9799b4bf64bc66ab71

SHA1
a4f1a0f620f1162cd45ca181a5eac4eb78a95597

SHA256
4f4ce389afdaea8c9fe22ed6272ae67eb4c768f6708e65bce70cbdf7937e4504

SHA512
6375e362729ce7e93061fe9fb6bbd9769b521c3027e75cbba2d58016befb01c4e8d12686d5cd55d4533b97a1e8785857751cbf806b85ad22da15238914fc23c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad455d200a78fbedb77a33dadd0cdbd0

SHA1
58c42882bb3ba48d8315bb0c0fbfb61f6ae2f0e7

SHA256
4bcc27c1378982baf111372c5b57f22b08a37c8e77a6114fc41f89d9e78ce99d

SHA512
40a398512633f6683617d4d3f16e4804cc48869e34265b5b3b15de676f333053abeaeaddf392a7fc87119e9aa50e6301258d5a3c0f8c2c321e64cc49b022cf7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3756c2ff9bb81de00c1e595028a4caeb

SHA1
aceb8f03ac9ca44a16594a53a2ed39b4ecf3a2dc

SHA256
f5d3b90a2bfd427d54dd50bd10dfa4977c5f9eb65bab18190a4b615c48cae218

SHA512
4a2586e78a91ef2a9e372cc638dc10da3d5f58d4e2783a76800b6bf3d00fdfb734904fc7aced437425a7840e2b0daf51c5ab2afe01196028d8cc08efe12d56ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17645b05d3dc31230150eb81580e872c

SHA1
8f7fedec305fa24ba46c4fc6b9ebe4eff5cbd340

SHA256
9b39951aa7e81e7c81334b7dce634a6833b9626a98f9df015beb198d524ff35f

SHA512
4ccd29104fc167156a73ff27208e15959798e8f3c88c2eac66b5b4c4a8c648d0deaa53a40ff5fff190e3cfd71db631dd8a006155e2707c87cff2b5dfb3000464

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0fe63c346b429bcc344c253667ab819

SHA1
2f31492992b8785888e2fe5f326a2da74f5c178d

SHA256
3ab233f7fc9155ebf373eca517b3e9cdc3433c5789f57e749c00daa16614ef35

SHA512
7bd1bcf17124387a739d7ab778b8b69475ed18c6b59bc3b4170ef56a6720e5cf296e1895141ab7853c62236960a5c9e6297fedc7785f3cba80e7f75adbc5efb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47ed75fcb134a0a20fb3088dd80e6f37

SHA1
4c8b3eb6c56f1067699f3288196f180588e398c4

SHA256
70ba17d3b067027f9605fb5ecc56b0f89f7daf87643d4395b1ab35516695124b

SHA512
a12a7ee4f10bb4d16d6efeb90fb8f0949342a735a43eb6052914d773cfe71fc89c805cdb642ad502fd93691102b580bffcd3b7a1b287ea39ab944e495ced2c43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5219.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar52F6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit