c53e4e632a08b78953d65085fbe68dcf3863ed2469d0778595d014e56f703481

Analysis

max time kernel
134s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

597d0182f03642452f220325996c74e4.html
Size

4KB
MD5

597d0182f03642452f220325996c74e4
SHA1

b2fc273a91ef69d221c735e9120c21543e8b39e4
SHA256

c53e4e632a08b78953d65085fbe68dcf3863ed2469d0778595d014e56f703481
SHA512

f4d25e1097ec79ab6ec39369622ca02a7ee61b3423aa667ee214654cc1e8f39cb3b46b9d2504a9d44901930934d24e6e77048369278d84cb6df887a1cc0be40a
SSDEEP

96:rf9seakGiwLsvfpFFOxUEovBUqsOeN0Eg9jag0MwU:rf9FaL7LQFIazvBRlVEg9+g0MwU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411344127"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E742C481-B25C-11EE-8301-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000795d038904196563fc4be2591b6b03de9ab77ed688cfe9fcdb3171424e27cf84000000000e80000000020000200000007f4001682ae5897ddfd041fab74ece354ef29504a231c142cca29ab11d6d27f690000000f9e814526725b71347735f9c1e35a5c99139fdb4717589f4f541168d2f713cad6d1d3880cb1f2d6364b736fa2ca6375535e743143ff0798d1b16dc84d96ad0d56324b256dcb5f364e51a059d01080804eb0051f03e440a2ff37ad593a1d52c9ca09a60a40e2c3fc110fc6251d269a7f8eee5de07faac49f0568753225e368394ef007c2beaac3612ed2a142201d2690540000000f76c4bf517accaec2e5c1a00396373d6330e5154438fc5dc8833e027fc614ce90bba29d7eb74e340d2a584da9763b6221f9e1196e60d5110d526e9f4ff6ff1a6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000006fbcc2fdd8b3d976dde5af59223fef1d11d4d55144e7bcef2e12d9c7d4ab251b000000000e80000000020000200000004e0321cc5c1e2fe3d0fedf192b4db692c8749f3b55088d2dd63e8a472398b274200000000403689b1edf97e51448d799c1e2a9c6613cf329649e3990196053302f53051840000000d355cf0927dc1bd113a07dc2f24af590b8e6a25363e65be57cc0ea04ea31acc849434bf7ac418386b0c514093d876ed27ef775ef24351741d7337d4f84dbbfc9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a06232bc6946da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2368	2208	iexplore.exe	28
PID 2208 wrote to memory of 2368	2208	iexplore.exe	28
PID 2208 wrote to memory of 2368	2208	iexplore.exe	28
PID 2208 wrote to memory of 2368	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\597d0182f03642452f220325996c74e4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01aef563c500c1e5be6918043f75d082

SHA1
f7bec83aa4b837e35eea20c837b6d685dad3c1c9

SHA256
b3edfb3656c4c415b9f61bf405466c16dfe3a831cce9a285c86da1554cf54007

SHA512
7784eb7166a82a1b8ce0f1bf4925f3ea8ecf8a9f1685926ef62a6ec410a862612ef6ce8e67a6d470da2a5ef9a1efc0c4fe48dfd5a6cce23f1453c80f312a93d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be5b058a07386870711938d8c9297924

SHA1
8ebfb2b95a40465da4a7db3c8aa0981bfc2a6e5e

SHA256
358fac036b3690670f4dc15e9122628d27f01342d954b67a1af56dfda7789d92

SHA512
dfb0a31edad353f16d0dd36cd4ea0afefbbbab6511c90780a523159e0f61e7f2c7bbaef1010aa0f5e01c454799f0db49570d8f386d466b23f5d143fee0b5038b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b277070c1c55e028ea155648c10c319

SHA1
45de7d9fea42c1541f3f8a7c612e575a355e5752

SHA256
141f4156c67552cfe27fea393aeeae17d7b0a122307693a78c2939b8385110ce

SHA512
57aa5c53edb170409660f67006bffe87c7829bb07bfd0b374cafa89835593109ef422fad8a78dfee827840e92c018258b40685aeee06d74df8b0c0b7dbed8264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c4e046fc84d71a9e5f4bfb54f5a776d

SHA1
9856dddb4c69390699e7a2df08a7c2cf204f2975

SHA256
ee033918bce37821abac516d1b10c090f856c0cb564a75379520191897e15184

SHA512
6f6e07043f1d4722a839fabedf63ac7d7487af7c45f8bc50f140657bad7b0cc2e677d5ce69ffe80b80716122a3f58d288b347d1265a55e5d349bab5e9f8de098

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65862a245c4836c979eac5a7384294e1

SHA1
021e49f552cc97a0f7acbd8869ffe63827ebd921

SHA256
10d86fcbbf2ac391878c088e6f7b6e5daaf732c6e540aed220ac7857949c6e97

SHA512
3c1cce2ccc4426a51c213e1ff8fe07f7a70aa1a9b474b12d25ea572a7d9d5d9d7772945558bcbd7f40b6dca8e0f91aeb649f4fcb39d7399a31a37a7a2909d8ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58ca0c66064ac56e4586cb8288713c3f

SHA1
7b6b1d561b37b016ababc650cbac5c74f106812b

SHA256
1c3aea9ccf132db906ed51db95ae59e2d7a112c95a8ce417ad7110c797edb749

SHA512
414df2a3b8e0d2fdf3427bd96e3f024fa531c10d09fe621219726d3feee890cb727d748ce5c2c3aa997cf900e58d0f1bac93be3dbfc57418cc9064f11b56b863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03ecd12bc14bd658d1c9bdaf29ea1659

SHA1
f367b7c1cb8ea0d3751eee7f9d7596b6d8e60a65

SHA256
1c71420a3e97c7b42cde17b8ac9ee9cbd72ebe5ae773c2769b8d023f5d999048

SHA512
f07132dcb73c9cbf191b0f54e01c4be11af06aa2cf3a874ea6d8d5b001704e9888c1e70b5e3705af6fbb6efeffa7c57d750b318d3a0c3cc093d61029ff448535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a86e8f8245d7436194eeac8d3965035

SHA1
45ef0f31d1881c68ec4606e343dd6ddef1f15f72

SHA256
047f3d5476367dc11913fd3f1a524033df7933d85899be1c4e4b8fa65b9c4a84

SHA512
ea62bd66cb5afbcca57078cae464ae869d36ec69fadc24d1522c0bcce67eb301d8e7c113e16bae6d96628c20710be8e57c6bf3c66216afd2637741ee5ca4ed57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1961536470954ab71b7a42f392bdb26d

SHA1
abb18c3882a5fcd4e3da4786e8b0b42c59d34cdf

SHA256
77ea2ae4077e36e0fbc478f860f03f049878cd9fb646d26666cead1961984a32

SHA512
d45929b09d800e3fcb1f7c94c9688795534c418fdba183dfcefed1e658a1d0235d8fc2af7910469d7b4613c8f54e72019fd7e68e9f6eb56ec1767434e9fc90e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54c8c23ed46ea155df05530af8439d74

SHA1
4ea05785e69b93226b2dc30b281ad1f49c72eb9d

SHA256
929e1be5dd559bec071aa3e05d587f2801274f3883b07684dd85d2b1afb0e50a

SHA512
a8171241560d22c202b65d2f018be8cb2eef2f65d356e01276ab5522aa757c0607d26f22b29d090d2a9d0ed90ac8bed337a78c2e38a94346a5967c470996a828

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93a9c917fab3bbfe157b09e819f67b08

SHA1
bd43f2b493e3d904badd1d5018e96044baf0f9ce

SHA256
bafc38d3faf107623bd6da5673e2c9242deb33332a3e3b446e6c79aad280e63f

SHA512
8201820b3b16ff43f2ed4e23a2e3f3806a1cf65fca7a543606012bddaea1bece6101af7ffde44cc38baa47ad6f516dcb929dfb24fe4df033cdb4e0a6ffa6a032

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8318.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar833A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit