e6e060d6a79bbb84059e8fd88ed81fe097bad11b44edbbc57506410d30a79985

Analysis

max time kernel
141s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 20:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5765403e1518a38c0f2099cc3fea8a0f.html
Size

19KB
MD5

5765403e1518a38c0f2099cc3fea8a0f
SHA1

99b6ea3510d2b3b78d44c437cacb2af346f95702
SHA256

e6e060d6a79bbb84059e8fd88ed81fe097bad11b44edbbc57506410d30a79985
SHA512

062004c087c7459529caaa43af5847900de0d41649251842268eeb1dd92888ae9a202c32e12a43be9109ce2f30f72329f5a200874057a154d49f54b396d705a3
SSDEEP

384:ieWN25vKElUDDGUer99rMiHkQ91TAyIqp0cYAeGj8:TWN253lUDDGb99r9HkQ91TAyIqOcW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411252274"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A1CE071-B187-11EE-B751-62DD1C0ECF51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000040ba4aa2dac87e25ba92d014a874760bc0852ae20b30dc5083baf97890f987a2000000000e8000000002000020000000bf0f04fa85dc877a2fad899c4ccae8a9b3ee383ef1fbe94994ee977c9edfc33890000000cef1d05d950bc1b14d5745e001a69f4d17cddf0c5e0d2f0fcf5a869440af8d211d364d656f9ea5277a0ae95aaa31becd0d120aa44dedd69c2407edf250b79fa05850cd3d1a90642c073c7662eb79fecfef74ad160812477b10c676226c14aac3aa8c675c3c9645e710f249322f3d226601e58bcdacb1ffc01464893a0998167bbbb90d435eb86b52c2697538e7e604bd400000008d8c9032286f4b27f3b05a54620eeb7fedd6956964044d0c25ea1fb5e5ab047a0f2ad55caffdaa783db26cff471290dc19e7174ca68094477e3ac2a7c4f89f61	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000877fe9678d9b445d5091d4a7ecc16f3781a90a32aa1a23dd066e3bf8a1100776000000000e8000000002000020000000610591f770e814d538177e63b7997395f7d0e637e3b8d1040e1a3b2cf2c39262200000008e0bc2db8ede190da7afd4418c1bf6aee9e2f2bf578023a6141cf0b65dde424940000000c3142283bb1845dd973f38b760926c4e2c5bf6527cee190f473a828c1a9aeb94d9805ab57a9fbcb9db29ddc9a89199196c20283a4239715b8d14ec67a763e076	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30c5d0e39345da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1724	2964	iexplore.exe	28
PID 2964 wrote to memory of 1724	2964	iexplore.exe	28
PID 2964 wrote to memory of 1724	2964	iexplore.exe	28
PID 2964 wrote to memory of 1724	2964	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5765403e1518a38c0f2099cc3fea8a0f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
353f2884a5eae2e360e9400767d42a86

SHA1
cd80bb82d75f982951ae5450f6b4a12792197f7c

SHA256
c7f6a09c8165027a44eaad5189600bd8c82bbe7aa12855e153493a910a65f2bb

SHA512
116bf2a85fd0e9ea51e29430aa229355cbb785ea7661d4cd39053fc621dad1ede6cf4553ce44893f0b3f9550c4160e13d9b76ade5591e6769aca03bb0dd8f8db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b04f96b1754ff142a9881aae04f722ea

SHA1
724f4628720ec973cdaccbf44287473a80898bfb

SHA256
ac8935d8fbc4aedc4d34f837adb85909ea47e191fdfcf8167cf6a1448b3412d0

SHA512
f410dbb653821d036ff2dd0342744eb2c6ecfa1632ccdf3321682d3aa9c79a0fb62127c8b9753751a7cc8edebcc21b8a1310ebc7fe888bae58de6a569ecd01ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e07b6e4b0842f5510fba649cc8247be

SHA1
e31af9b86325210da5d9160c7ebe755ee2de65e5

SHA256
13d7e0d83b846cfa27ef4e856146e395892bf03c2b2fbda56b625c19926edad9

SHA512
b53282ec60cf39288e7fd9e9fa46276989fd9a4c7b9f86b2430d47b5d0ffc93a40ebbd0a2f39c9e0913e81ba009f367767635c3ebc63dad60582c80b6745b118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84755b3eccb7a8d4ff6b923c3f35c53c

SHA1
e97dea2426fbc4f1c7e8cb07271e60a838bdfa66

SHA256
ec36ee949709d7c06a3d6ffea1430b1fdef9411bd342629c7013fae107c929bd

SHA512
29e7b6cbde882292af1648b4dbcd470f2bdd044d0284c699f6339594bd23857ce50468c643483e838f41168db9165ecd5446bb414f1591cf4695ba7946cecd54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9201ecade02e76cf76a6be5098d9f691

SHA1
38895a69fcf81fa50d255d0add19465c34992aea

SHA256
bbac6617a5bbc3c9cf80f41c26b2c81b5aee0fe07fe061db1e4cd57a2331cbdd

SHA512
f01fdef2dde3c9a0fef335ddd46c6fbc7a9f3155a9a875e1a2a0fd838f80e236b6c1da2ac5a614bba011abc6b47d2f3f6261fa33f8bcb03102d0d46b66b7ddd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b5b9aa45e83d394c17e9e890df65d3a

SHA1
3636d627e80b0970d01026c7aa4afc2d2556f75f

SHA256
f08afec9e4e36ff63a513770505be7af82cce5024da93e4d071eb1d559c3f289

SHA512
4c2985c9f98dfdc6c2981106461115a4efa9598df711537c518c7ddd3e8287ed010f45b41fa5c2d7ccd40696705af53ecac218600d95a857efa0e8fb719bf44c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f3579233a35e2712f4a5d31156473a2

SHA1
0346b1fff61f0cf3409f988f0e8622072102342a

SHA256
846359197d47a5e5b2503295fa0cd4609ff36dcf91ddefb4c4bfb202dbd87dc3

SHA512
579e9191675f800730aef186fe33d09810fc7a5e5be36522fb765d4c18f9d5d9046f375b1a50629b3842d267571fafaab22e5fea6ccd0fd4d7935bb6138ce794

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53cd1eade4e977706a1637ee6bb943ee

SHA1
bb21f498a5a1683647acd00defd4a1458c4c1e1b

SHA256
81f81d96c60c9487e12e714fe649e8df48dde270376baa2cf5d562d567002d7a

SHA512
55fce971e300717edf60b4668e2967f31a25f950a0ca292cc0433934cb3b27b6e053a6e9b5732876dff13bda466881d6351afe481a75ba3f175c83f6d9240fe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
757c85ee21d1e46b68ce27548c615733

SHA1
d0b202a1e59160f891a920adb5c6dda90d377214

SHA256
3e7d289e32438bcba159a9032dce3cac004eb94ce42dca939fe1613bace60e6a

SHA512
e4e226b0092e145cd20b7926464eb4abbb58f1f2d46d02379cd5aa3cc11f4e15954855969019dbe3ae5efcd023ec20e6274b554b9ad294654eb614cca7b1d40f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38939e20059e615737bb11f8102be101

SHA1
6258154212243a01fa9a324feea71ba3b6f3643c

SHA256
3c1f0d2f587442f626ad0cffe57868ae045c3fad886a3547d8e24467b578573d

SHA512
5a0e546e99aaaf86b54105e342297bf1d928e605501fe57875b881c5e5ee332bb84f39f1ba1f29426e77dd834755f678c0fd86bed35522920e20e23137533c3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
814c8e72688e28fb776ef9f0dd40f43f

SHA1
98e9a92e2bd01c195da3f2df952de3ec60821bcd

SHA256
9e01869a8f2121ea4fbf86b1a2a52159896bdb0aa4847e0ce5e3bb1312f5addb

SHA512
681f695e3f4165c5bab68a3d859f7c8117b66ef4054ef4a972e370d250709a93598851628053d519433bbc3bd60e554d22b7e3210be7a22b503c3e867aa757c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ec3ec5445b9a73c226c509ff5dc870f

SHA1
534e84114264caffff692f478f348c3dc64a67f6

SHA256
17d57d2164c08f70e98ea83ce65ceefcb9b2003f5bb38e6eee4381c6571a84d0

SHA512
eee195456122b4bf7f9718ee734aaeb4cfa10b44899765a7e7bae818c3ce8eb66ab3d5ee139b88ca25d9398140c62038d1470fb0458f4432c0a35ced3f757baa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d25d2f56a1e808bedb5a0584fbe5017

SHA1
cb82c257cce1b375b401d751999390e31053c1ad

SHA256
7aace44fc5c65947282853f979a5fef01f85d582055c0367facd7f52ae4442b9

SHA512
d9f769225184fa14328a2a2d378aa717b964842a30f59500a159f8056c544c641c9c9c2904792a3330b37282b451eec4ea1dc3e2b1e00b356b06b51315fd9374

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f204dd602ba9f23516f93837f05e9dd

SHA1
9b3c0f778a425ff3bff9a4f56f54b8dd202cbd74

SHA256
d9f9f56836e38f20053470dd52f8541bb59346188f316baaa736f889e55defd2

SHA512
190ee417b9c1b35ef850fed9cf74162d70ebd9559eb7f35dffdb36c074c80aaf87afcb27c20770063f9673ba266b90d2844d254742f532f94ce0e3a5adfa905e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e1d8d76624ef86744bec63650100eaf8

SHA1
c2f115fc9f214fe53b1ccf0239b81ffb040efa6e

SHA256
b73690ab15a9d388a23a67ab1174e3d37cc947a9d9a01bce327d9e1840cc50f6

SHA512
4c7266ede928526da0e251f8e6dd5a4a2054cb9b116991e87b32188d42e6331e7c45c5b96103d8658723239bccdd3503c76ae0bc4c6a9aa8bb18397976552801

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5735.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5842.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit