e9ad2218bcbf178c6f43ffc5f05b4b5b332c81a09d25df0162ff7fcfccd57869

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

598352f4335d03a58bf7aefa20b8c4fb.html
Size

9KB
MD5

598352f4335d03a58bf7aefa20b8c4fb
SHA1

ffe81c5190d89b719c9825e91bd13951ee541646
SHA256

e9ad2218bcbf178c6f43ffc5f05b4b5b332c81a09d25df0162ff7fcfccd57869
SHA512

fde36c51c88e96391533aaf60f7f3501876941499035efe0e59b97f0318d6d97f71508958535657d4ce9fc048d18928d57c43108c846a2e65a7bdf052534a5cd
SSDEEP

96:uzVs+ux7lrWLLY1k9o84d12ef7CSTUqGT/kPsUR9pUlVHcEZ7ru7f:csz7lrWAYS/PfRvUPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d780000000002000000000010660000000100002000000026893f28c83a834be858579fef2d1086cb4dfd644cffa49827272376aa16783d000000000e8000000002000020000000c4fb582cc186bfaf6cbbfa91c3487033a11ad1a971600420bb44d78e9e62c299200000001dffea8d7290e600e61306c9b45684264c0b13b63d1e00895a104db33c7d728f40000000aa8aef7854a433999da1a0a148542a3511efa07e778c388053c17e68d7465f1d5a025b38e993d558ac5685fa538f771c445b59d57114a5a461f86f86ff984d9c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA066011-B25E-11EE-BF0E-72CCAFC2F3F6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d780000000002000000000010660000000100002000000046657b1da8c16e065fa36f03af132285f108ac4620c6bd20c2c7963902b15140000000000e800000000200002000000074ccc81427611ab85cbea77fd0c24b80cfc90d70c535aa276f1d3ad9febe989f90000000ec3965559e2b069c64356d9cf63450b634ef86c9727395bbe66b6bb4e3aeffe8cbb7d2177a9f0959761db886cd6a08f6355d5a28ed9b1ffd78b48216f37e43f88426240a1d8b519af0daeb632ee35e0b2adab52df51b18718e0fa0698c032cf957c06e3543326cde99e7ca8af0a284dc3a15607c8efe15642854ed1384db7ba77893f65372869fa41c1f6594347c165240000000ce562210bc4930765a953306c3ebea6e2b723587f00d3e56dbbec6ea4f251e50e90ef9be2f9eb4d05b3c8ea6a3837c71f7c99f40fa86b75c075d83d7ed629856	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411344909"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70bfcf906b46da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2968	iexplore.exe
2968	iexplore.exe
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2068	2968	iexplore.exe	28
PID 2968 wrote to memory of 2068	2968	iexplore.exe	28
PID 2968 wrote to memory of 2068	2968	iexplore.exe	28
PID 2968 wrote to memory of 2068	2968	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\598352f4335d03a58bf7aefa20b8c4fb.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
fff6568060080b8d1d8f925bf4c88fd7

SHA1
b87fde80d511411063676c13f344c4b9f874e4fb

SHA256
ea53408ef3626068f34d3e680cb61711fd10e47e5b2610882602d8bccf979ec7

SHA512
22df67bd818ae4d8cb9e20c3fbbc79b8465c5181add1f6ea7fd2d9c11e8635e6c715a6af55a416c6e687f02e894d94be0ac9260f17b9e181ebf35ee4b76a0521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1aaf97b2f1f40abdb6ef56ed92ab9c84

SHA1
dedccf166074cb0e2595fb5678d03eeab4a9f356

SHA256
10a9f1092b314bae5f6f0897a3ca7316627070e70742f24383c8cafbd854c4de

SHA512
81d68b86e5334a8cf52b6721a5b8f352761811b361608996845384f0b50e457dee04e9b858f29d407689a30b127b427b7d01a236d55d8ec3423ac6ece2e31b20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9f5d1a8768e9034ea90e1c6938c15d9

SHA1
484e3a86b4c23465369ebf77c770e5e2634b5aa5

SHA256
170a39d61405570126542b9318b5ab33e2b73ab2ac32ccf68bf04414ca478b8d

SHA512
93e2c005365704fc054e48d6954c2d099fc5b0b579c1e02202c8896b8fe9f20b278ccf9fc7eb19d59100b8dce252be61a094b50a442c97956d31f3ed66b40900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14511d6563b734ae6f8ad2f90aa1ca85

SHA1
bfa1a91a1c11de9725b934c77518c6d8e0530c85

SHA256
9b54a794e3b5d2c417286f0b3640c5eed213a33cd167c94f1232dc60ba26260f

SHA512
d68f6df924e0cd98305d720e7e54597abe67c92c951ac0dc7290e99f771bbeddfdc969978e022cc3c6f23a0e2512cf2b506c241e4da99404b9926cc1482d03e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8047efbc700e919d1ef11b8e5a4a77d

SHA1
850c1de78aa02e236a1b5c8052ee5da517b15584

SHA256
e60c40204dbfc90551c925f79ed8a548a6cd5fe9f81f6547a35a059890bbbd76

SHA512
3034bb01820492030f96c98bfc7e9720750c06bf856c8b314f136adf9ae4d7974e9a579b8bd35b81c2be461ffb8f3e59cc159a8718cb06d2c83d482d84aaa05b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88177fd170c26bc7290576643ea1f4e6

SHA1
f031c6137c7ec06e775c057fce29d5d82bfe0657

SHA256
60ee6d19f4acbcbb2df1c88602cacd0041042544a3c6e12170cd686872862f7b

SHA512
92acbcbdbe5bc3bd315b65bfaa88baeb1d52c2f2a7b9e55469aebb2d07062a1f8ef1c7e5ed879b16ed061c1b1aa731bd3458871593e4d3b9480196b7a62e51ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a124a06195aa53132c011fb916065b6

SHA1
8b14c5f3fa18d1caf1bfa7cdc65651602bcf6a01

SHA256
8f0802491da5e547d5f4274f58fbbc6a7a0e2d1620a8f5ae3fd6d9810df39e63

SHA512
a934f7c5824a0f646bab13348d7a415f412458bec769e2f736a7de5a6023910b3807e107cae64dacc1408d800f6c86be062c53c636a986db1ac3f29849228028

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ccf813f9f76f549c0a2abadeb692329

SHA1
ed5a5bf8e6ecb985d968457927e75ef7365ff91c

SHA256
00edcbec47fae459aa39cc098b795e3c7b342f74f7af4cb0b4896b8acac2497d

SHA512
167fbca1b520fb410f4e65958a4fe67fc84ff03255f9b745f7ad3446745b3acf6741d95be8bb9307ffa0207810a42f2eae28f78ba09104af1b977b1f31d4015f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba73782d926acf83301e6cb28f10ffe9

SHA1
db67141381336f1c0c6738240bf6632041835107

SHA256
70ca7c8b37d96aafcb39c424e48831b827ea8be9fbc92a03316b0cab72277037

SHA512
66ceac44234565dcbbcd58d2b550ab1df87517c7b4f74c2722c07fa6a7f987ce6a3b1222d637531c70c2171156e8481c79b61a80814ed32c0c05002d2b6d4b59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a03594686b2679a8e784c2327674ac9e

SHA1
8df341b72521ada25bfe558f42cad070dde5af4b

SHA256
bf63b357bdfb169215f60e4d1b8f370f08cbd02cc7a4378262aa6b6bbb789eea

SHA512
63c2d006144d4676a8bfbbf31b6a5ceb8186e38f0f1bd6910cc2d678c4ef640d798b5c88877f2cc4d60a2bce688eaa59fe911bf62fc730a1082e28ab6f81be44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e023f37ac648dbdf434e2a21738f2d00

SHA1
fbe4e74efe72cffa4c35f1419608da22428c2c37

SHA256
2127271e4bddc2804a3a4257886a9a1ce49e1efbfed8641b684efd3c18670b89

SHA512
46e50a669f15488ad178722fba7944420849b5f977b88d11d61dccf93a171b0680c4c6add7d9872f59dd09093652743f671d13137b13671931206e80cdb213ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dea97658e94ad8504dd51b75d8ae006

SHA1
b676dde0f9a290653a6a7dc7bdafbbf740c1b450

SHA256
2b7591bcd12f0215f6c07e1bcb102516c431d0716828e73d951a159f8e752862

SHA512
3966b57c50684c44033888646930a5ed75d69c80f683e61593af02a1164e90f9237209322c64a3172504f7a12573f9e7b3745b92280ca3fd9466ba8ac2853242

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
807a689a698f009b00dfdf1367215096

SHA1
3359977c74eab55d098fbb4740122d401d7719fa

SHA256
e1682f12ba1903145fda47074c939cfb8d26a7c30118fc24ccba06eaf39967e2

SHA512
5f8a7b3b09467afd63055ce0602c3b2f724923f315aba4e2e3ee6bffc7c47230c2542e213a79724aa87bce4f7b17d33c470c2a6045b4d627505aaac0c5e0b03b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab403C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar40ED.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit