e61cb252878970941042aa388b15a814021fa26645feb382b5f8358d64909d97

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39b72753ec9b0b71fc13349b06ef36f0.html
Size

53KB
MD5

39b72753ec9b0b71fc13349b06ef36f0
SHA1

c1d59aa1a6b9bd9e0eaa803877993f5a0c5448a2
SHA256

e61cb252878970941042aa388b15a814021fa26645feb382b5f8358d64909d97
SHA512

fde9da9a71b3ca87647f18efa0e44b1ca69113be2ff08eefdd8b299a25e4c3001c995f4759e0dc573bbb7333470bffc0423a6d765c85d38bba19adb0411d6498
SSDEEP

1536:CkgUiIakTqGivi+PyUqrunlYb63Nj+q5Vy0R0w2AzTICbbfos/t9M/dNwIUTDmD7:CkgUiIakTqGivi+PyUqrunlYb63Nj+qQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2C7CB61-AFFC-11EE-9324-DED0D00124D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000001bec906ffc62423cb2ba382e32d96a2a38a583354435d58c841bc09686d65a10000000000e8000000002000020000000505b97ac7d37d346a8e0047eb3371ea87fdaead5d4523bdc774f19cafdf8d0f6900000008a39cc787681a6a5b6adb551a305deb0df94036bee53cf9eedb60ce5c0bdb1a0ac56607a1eb7a3db1b7e12174e87368ed5e5def9aecfa99d0e6c1de5b5bf1051de6bcabc7788ef4bf0d3770c8f547357befcf12bb8093ad130e3e19f975201da999d1e48d4ea7b855c04db2f37125bb23f2978118e2c0606306169dba0471dca995fe4c890f10231e2ec6dcc41239ffe40000000f1b8fcd068ddd4464c2c64ade6dbed344a8f200ba88f8b970e914d3555432b0b3ac7784b9813c3861ec7c08ca82d926db14a55185b616ef82e784b485d0d51fd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411082987"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a75fae774d489f0ba1338ea057bef2f4eb5d058f6f9c4fe1fa4abebfb323b244000000000e8000000002000020000000dc202f666536704e52f8796e6e758848ba895e97bb33ba45b76d9f55503d343f2000000041545a12161f427acf69ac418da9f26efc51f3843afc37246577c3cdae28a9fc40000000d67317c44b3d6f84aef18fd0cfe4295f99402a886faa30502e79f03baca1001e0194bbcdb74d7b16ef6df3c4a6d0a9e91c2962923047f43fd0d51528b949fff2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d16fce0944da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2496	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2496	iexplore.exe
2496	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2364	2496	iexplore.exe	2
PID 2496 wrote to memory of 2364	2496	iexplore.exe	2
PID 2496 wrote to memory of 2364	2496	iexplore.exe	2
PID 2496 wrote to memory of 2364	2496	iexplore.exe	2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2496 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2364

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39b72753ec9b0b71fc13349b06ef36f0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c66c6a1aa002a314a022ebb7fbfda092

SHA1
cb69b5f94fd69250c5fc05c95f5751fe04d9bdf1

SHA256
51217c12ed801657b059cf439ba02fdffd8a23789c4bdc4e85725727dbc95626

SHA512
0ed4becff00bada585cefae7da0288dfd40be39face565a07eec5c39014ddf136bcb3f4f070b782581134ace7f58a350a30f7c55aa3e0d8ab482e6a6b412fe03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86fcd93cb83500fb8c5e6c215e08f185

SHA1
96f4d212a2c5ef11e7cdc97756d4dd89db12c394

SHA256
1547364f7a27b70a6ffca334825a469afa5dfe72acf0140adfa5d17e53bd5708

SHA512
fb909b48592d77951f17641dea219fa9f78f3e670239c70372f8e06c87c6b8bc45ffcd84faeb1f4b2b3afee9254db44875c4931aaa68936fa11e5fd61e900a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
562302b6b264d0e35bd9f0a778ddef7e

SHA1
7f77d28c0d532c49667154f19e784f9daace26ae

SHA256
91cc1395f2bbb81d9a1759da3b35923752350bae51dfc8cf0fd5ed9aaa4cda23

SHA512
463527a64969482b1942de2fa786dcd2345b8efdc75bbe5078e9632678a9cf1ec73c72808715b20c967235f2a115a92819700a486f1a7ac58a9a4ca02d5dcac2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acb605ab22d087e0aa99d96d82b0e68b

SHA1
87c5584689c675966fbeacde59f8d68661cb4716

SHA256
86431a42887acf4d426b95d7c07159a1ffc9ba1b6e3a1306604ebeb3c07fa4dd

SHA512
37defb42b147c8401e854b9353b7ecee696a55db0964426072b0934461a4cdfa5c384ad6d2d1b2858723d9dc6f3a6a41a0144ccd6c1323d63cd701f5f4b66579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7879150b1e51c597d3e4803189fb096

SHA1
21b0422fcca821c2f1e0f315faff82ca0db42965

SHA256
9d2bb8344e76553fe6c54909b8a1a676195289fba3bbd93357725fad546b87ff

SHA512
7db8b610f92f411933e0033452e889d3415792ed1127eede87fd1d7ed1bbafd3e07e3ee42c7fb57adc501de0d93e2a007eae7b60cc136beb9f4f9aa619e79b3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb3e5a192d9d320b7749eaebe25d5d8e

SHA1
04bbb094a795bd3033966d9706345cc04bcf4505

SHA256
2db5e8efb70383da6f1d813addb9819005031a1ecbd3f0a068f4d9866ae1b9ca

SHA512
10bdac8ee5e823467342026cd3e6a518a504b1ebbd14dc9e05e528c5cbbbb309b2e15a7ff181a138d16daa3aab764c998bb6276f0612f43b3e34d94f84d5fe50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30cffc195727421251912e5ff1be296d

SHA1
a8e83b930038007a34da5a371fbb65306acbd0e8

SHA256
8c4ef1c157d43837b5e90dd030ce9ffe3c1ac9e5d7129e4381417793510560c3

SHA512
7e1becf8827753893c4e5d626cb97c992ebd5b8581654fd3d71b664a1b6d513c137e628dfcd633527b42dd72d2f4aac4e9697bb0662cfa7382a9e485ebfdac4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b025b9d5b334a820c8d699b0d0801790

SHA1
adee6047994fe9f6a839036b9be23cd3f714e86e

SHA256
07cd6f3f5b0164d73ec4b7ae6931ae54f6de8f1172e7b8e0bdbbd599c4875b29

SHA512
def6b443044ccde07e5b1bda564fa260beb2126e95083c144a823d2d8c782f9548f256f84b703919dd1b04c5c2c4821f69ba78b2a8d7c3bfdb974a7b0965eec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a9c732972b0269a72ff2f257f763653

SHA1
68bcdc0d8380365d34c0db617d3c43af2640069f

SHA256
27d517ef02d3eb3142904501cd725a8fef8b9601f45f2a315eb00dc4203f829f

SHA512
fd5015352c99adab12e76cf88b9051c311157b6a4803fae6cdc2292112a18ac5b4db62695560197b67eed02131855a717770a2a45981a040359319b319761b74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45b2516bb05485672a0a12fa3344c0f8

SHA1
18b59a42d2949471c654c59e1eb35831ed9efcb3

SHA256
ce1fbe650bc4ee147dbb91c16ceaeeacb48f921e29fb7d2cc7230906a02396f5

SHA512
d0e3191c0f2452d9de7af9cdde83bee91c20e07488e3e60bb9e980028c2f35214d4c444b31ce0c792db7d62b70b7172c8b341b164aba488d4bec1a9908c3d61a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9aa581421e82b7b1fc0db839ee88dc25

SHA1
ca1da9eebaec28b9144ae310aade5e88fa362bbe

SHA256
8376631e7e6f10f0f517ec4e41ab13bada167150e3a184a375cdf1896991aad7

SHA512
4f183bf49f368a519d341c3ff1c7c05e3b1eab4779d769361d3d00855292d533d491473acf19b021f60cab2c5ee04e2d2cfaf90c7a2e398da6a30448d6585f42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c184741d759e8e1be09b57b1d472f4ea

SHA1
0d342a7f9f8ebb410cfe687c878c0357697be4d5

SHA256
15209e9780dac3a31f39304192107d6be0537ff93dfb76f436237f3e6a5a7e44

SHA512
04199c05f17949656942ccaeb871f045cd7183589bab37c5ea7a25f609e854ca339482abf1016ef015dff76273a68ef19d9c5f843cad4ee0e5a8f06d8c0fce3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b025ab483786d42e139c653557cbcc7

SHA1
a3f70b2b951cd6da8f28465883c667a99fc0e705

SHA256
ceb9c70eaa1733d0b567afbcce6f737574f57a2f7e4f59a14296cdfdca7e21b1

SHA512
ac7f32b5e21780195a015474f817597ea88439776ae91847f084690ce41cd20f37f0ef13acb606c68325ebc6c3922a923e3198d8500735a9a60ef7ccfbd7d3a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7406afc828db4c385ee632f91e68bb0e

SHA1
96e76dabb1cb969c7d6d00916cd5e3b0240bec1c

SHA256
99b9e2b1dbaa871bc5b3bc2ce2415e356828bb27389175a246a593dc75afdc2f

SHA512
cf02c8728e8d241bed6cf079937975e8078a61b57cf10a9e81b24ab8439cbdb43d4af50451e78079fc62aad43212e13c7857ef7c86a341f24209d68967c1eb21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6acfb842442ff0f1709cbeefb2e3720

SHA1
6686affecaa82228a190af9e578790ca9d2a15a8

SHA256
fbbe20d6e610b6a6ca8b51d76819ae92cc7d71c0df6156bf09727c8ee0a9e7f7

SHA512
599c927f2090265001e622aebfd7d9f5b29ad573ac11152ff443d3661ae21341107dadcda36bb17d8c4d0ed5f773c965abafb579ef6b30be270ed8a3ae649e7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab52.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit