ba607ab87a38cccba5ae2a7a5d91cbb4791a7a8b0867eba1637a81c9c5cc3591

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5587d6663dd4ed327e663b8c1011a51e.html
Size

9KB
MD5

5587d6663dd4ed327e663b8c1011a51e
SHA1

983dc45ce0733fee57e4414e5b53106b489e67da
SHA256

ba607ab87a38cccba5ae2a7a5d91cbb4791a7a8b0867eba1637a81c9c5cc3591
SHA512

418e8fdc160bf022c80ccd2a2dba6733064fa475a22507cb1cd9e4b1d097dba12b00444d9a507e51d22023d7bde0bc7ae1479136cbe00eeb25353c50a11b5d89
SSDEEP

192:+BpwOoDW74dsF9wpczUWLKC/nTkEHQjWAtc8lTP3BoDC2W00L/1La3HcsCZbbeWy:+QOMK4k9wpczUWsP+coa0JV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001578149dae7ac1a1ef15b6ba00fe2e2e50a3a8af03cb3ad90853b4930ce5c468000000000e80000000020000200000005f65cc59bf43beef2a26a06503a896dd4b4e2f1bd1b2b8fe2109c2769bd3a43b20000000c58d92fe02e1ef79dd2dd23375229563679c709243385d732ca9d84c139fae6240000000acf986374427d4fecbf5d674d98e56fafa79d8b899d3072bd4c46eab8e128dbc24e180fc7405eb195012d7cfff6d060edce1d8044b653a42d1701ed3bbcdd11a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411196781"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009c4ffbdb05e78bd46ef946f433e4dee5c6798d004e169a6152d14b739334f183000000000e8000000002000020000000847ee482f3819c3f588a84973092a639ec4c88534ad5ca8a55982041609079d3900000002a482a6d737142a011b28ea735b4103e6c5669f79c0eda2a89a467cd32ebc6dd175c983a1e8a3d157f74d4faadb52dee615a51f1cb08e9e74963c67724da3d4d91cbd76cd45d81936f0a534442653600b8a523a3d2718de774cc8b2a9c8adf9bc1b00f0932ef851c3964b0011f754eb8e20de8f31a468885e170546cf592d45f23001aece2f556accce93546d3f6325a40000000bd6aeb4fcd5cf61832ebfd512698b148345e9e869c33aabe697c532a1916ec807fbfb8fd7d7f5c84972c994e341db0c979bcdc6e1cd6117e603df25beb967355	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00dcecad1245da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D571DCD1-B105-11EE-B3A3-EEC5CD00071E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1064	iexplore.exe
1064	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 2780	1064	iexplore.exe	28
PID 1064 wrote to memory of 2780	1064	iexplore.exe	28
PID 1064 wrote to memory of 2780	1064	iexplore.exe	28
PID 1064 wrote to memory of 2780	1064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5587d6663dd4ed327e663b8c1011a51e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c4374f9474984ca2ac9bfa35c473c0d

SHA1
d6143b3964b969daa4151de40f3b66f4baffe62c

SHA256
2862d32c40732ce33dea851604694199e90cdfcfdfdfb26c5f56f0fdf0f63c1c

SHA512
eefe9058224e9771553d39349a2065239a36eecb09bf2b7a20f85fa69a19e6d221fce05e00018ba85dc786355c73e02ca1e859eb00dca63485be5764a1c804df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b40f6730ed7c09cb85608436b656e1fc

SHA1
b05c1a52b77f52e3f0bf5a2f707ed3c30f8b0784

SHA256
e77611c145c09c67d225d89a640ac81367f34a84d8d51dc35b3d327be683aceb

SHA512
b88596da8a77a925fcc55fb3e33fed416a46f40550c9385c17d27a566d7471edd87b8b35819b376f03002cdab668a8d5067d35d51c29293e8938e3aa57b627f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82cdb1f2c78ae01ec9f6a5e24a9507a6

SHA1
e8552cc8f55e5dacb16d6c4e95bc6cd04fee22e5

SHA256
63e67d94bd65ac551e465b6613699bc23eb1ceae3bbce7e7fc3ce0514f693e09

SHA512
d1408e171bc039adbb84a24d2f3b8a87d02a0eb334b1b9547dad2fc338e17633d0d1788ec37765dff172fc4179d6d2a88ffc85264dab15725bdc2e4928944a35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36983d7ddcd5aa74fde0cf61659c29b8

SHA1
b066dd09b21fc2db098f2a027f0908750e352118

SHA256
dfcb242d05267ee7b5839bf7ede820361828cf92128c4ded9051cb357ec63cd9

SHA512
94ef025ce09e535676c4a9bef412b81006bf6db6b7622bea7dab5ceadc402cb8aafcb552cfee6b2d43432c89d331a8178473b71f9b70e3732d152dfcd8c9d6bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5786e666725d08fda30b5b53ef44406b

SHA1
d76065093a83dd896b5278968ddd4b4c69be4eec

SHA256
0ba28aed262c88052e120dadbf5b46d58b617ef6313ce75eadf889e0c32d6b5d

SHA512
e2d2f12889a54dff22a4bf70dc155d7bbf1192d2193ae70096519a602ab400e133683bcc18af23d8ee33848b40dcb3034d04ce93c20139c99204a1f60c39e9f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
944692f50e3cc1ba7eed444f6009141f

SHA1
838cefa7341a2f9ea171a46723ace8ec595fb02d

SHA256
eb67e4b7111f16d92999ccea284cf0da83d697c7b69c2b443f80d8ef4868bdb9

SHA512
ac58e0bc4677c3fe4947a286abffa3ffaea3c79db195860e612cc3431932ff1fd7431dad09f4fe7da2bdaeb396e11d7f261f9a186c52277a058fc4c7a9bfc4d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5648ed268fb2a44f1e551132d4dd4543

SHA1
14450fb154d902edc1bce4045d2a082051a0ae5f

SHA256
f805494c34d451fcb9bcd6fc479bcb8ba72e592a8467486bd974f705b4d23664

SHA512
ddd76f2c5f48d58ff061ac1cb45e996c8e8e1be3b7fd2fcbc35f9d73de128643e508d67538209817c272e7c379b7232067de92fca61f46b9aa63b723d87c7220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0d266e98ff2bcd904ba90e228636549

SHA1
ccbdb7b5334cff66753e3b74e4a57486d7be8426

SHA256
ea508e2cb8cafbdcbbaa84873eff5265a1f5c340703f09e163dddc70b1e326fb

SHA512
f68949a23d5e2261f01dace054719994efb6ab3900fe3171dfe435cfc2b40abec0ff47df1b98c0f4a277953b7f255ded3340b1974ff98fd38828add4c74ada7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b4b17ff19a069e48ba13bd4df660bf4

SHA1
d319c9c62cd3a1d10e3c8a40c2357e27cd5ca2ed

SHA256
f5667e1a1520a7f550b7c8a9f92fce0734da56ffdc50bbabd13027d2337d81a3

SHA512
caedd80a4079b010565fbe8d313f39b6ed23887a4181d33898dfe52863c3edd76d21fdc8a4161c71d0788fd10ce5e0f29f4d841c68bc939eeedf36c9158b3a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d395c909992fa232dbb41adee48511d1

SHA1
07e7273a54aaedfe10bcd8bdfc4c1a429364c38f

SHA256
f41c640d1b721963916706e2580168349e959448b1d2d5616acbc416adb6e6ea

SHA512
3e55415486f611db5379bd204f70cb9d4bb22996b04311530e6eb37bdc34d22393fd901e5da6d7a2e531a2e69124826e20b1c760088286537e7fb82226cc5671

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd65c8724076c1e5931c0b5dd90d1d5f

SHA1
efadebce131e6117c3c620ac0b1440a75c607b6f

SHA256
74d7af5abd2f46cd120b28a3cb98cbd37dd80cfea1bfc1c3005b9c15001145aa

SHA512
b1c85774a3a46c4d8635bb9d939060bdfb8ee6a86ba9e29f83088664f6b7a8b59d30db400a35a4729b336021f2ee5846448b5ea98a0f60e72164254ab88e2b6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b355f7c30f642dfc50065eb3923f109c

SHA1
eeca8ed9d56bbdf8f217d96ea44ee666b24c3904

SHA256
4061c9b93dc372d78a4655c8d37f07ebfb1848e7e4fc2ec90557944827c1c4e2

SHA512
c19d46bb204243d3ae650fbafa1fbd6618f74c690baa75fe19a20fd49913779c4eedc8d4379803162a2139c4967e78877d16adc10ac927dc4bcd60dc64b6ef93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebc9dabb8aef4f97bc0233db87fd6cf1

SHA1
ab77ba8c4d9a6ac3e9837efe733bc4684c22f844

SHA256
0bfb9dd534b8cbf7344ae841a3a507341814b54c9d37c7900a55aa94dc85d729

SHA512
af72c8b4d6ef3355b810728f751e5e42a67c97bc6c7147b98fe155f3df9ea4db34e79f232fad3ae21babb4341a99b67863ca86a2abe9664ef399a6fe0e41add3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59d5795e647591df53a58d1bcd1b02dd

SHA1
9416db86b0e5a8003b978794c2ee0b2fcb098ea6

SHA256
a8c02d45a6b2b6f532f76ff72774f53e3fc9ed90cda4a5ecee358e75d8eb12e3

SHA512
67b4b2c87d42c3e28dd154bfb1cb3382c5faabc21cd5d84a081d7d4669c2422da20e18dd9cce842ad63b26915a30b489b500968f2768d86e7c011b467fb4243f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd352461acfb0126338692caa86bf75d

SHA1
ffca49894ca793847b5166e5807f82e351204801

SHA256
3a16d68b01ca0f84fb1a555ec4892df9fcc96aa3db2a64fc6835144738752898

SHA512
2163f75cecfd88e3fce89d731a05e7deaf1af7c48fbc82695d8d2f07000ccce2f265596ec30dbd2f8447789315873150464b1f2839725bf927adf9affd3c138f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cf3ee2646d973e74d0ab9cdf74d3b86

SHA1
6940ce3112bf0947bab9d181a80c43a752704db6

SHA256
f80cc6d11da10a51b6885421303540db25e6bba065df79da486937c51b5db3f6

SHA512
2c59a75b66da50d00dab80b7730248be3663e090f9a6f2475431b496274c1f460531de916123acd2e4e30af7bd36ade6620bbb47ce9292797dd8e7a265bbb149

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab933E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar988E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit