f714a4cc4b293042a8aedadd8e1165550c65081fd4828a06922f706df2440608

Analysis

max time kernel
129s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5982b60de9b4f4fac0b76899a7ca1f0a.html
Size

74KB
MD5

5982b60de9b4f4fac0b76899a7ca1f0a
SHA1

d76ed315eab303887efe3702b7718882a67e24d4
SHA256

f714a4cc4b293042a8aedadd8e1165550c65081fd4828a06922f706df2440608
SHA512

7ae9e1fbd33ac37b01a09d1ad4655fe14acc6dab1bcdc567a3bf45e8a0060812ed989f251d2bdcb461c0581c5987daafbcfb647c149faad17ccc6f004109d122
SSDEEP

768:F+cea7aq6u0x6jQvy9lpbamnaTEgEn2kPaX/88WoWt9bnG18xWV4eSzhFzvNfzrl:QceG2CJgE2IIDKhZNf7NctOd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D57D671-B25E-11EE-88E7-76B33C18F4CF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411344835"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000005d869716f835636b47f1c51c8b3e5ee81d5672d0907b7ed7a85681d6dfa8708c000000000e8000000002000020000000e8166d3440fa4d0ba311c8a3bfaaa0513c6df9536eaeb528bda78712fc3d8432900000004f8bb167ce1188637d1096a6de123e6e9dd90774857e01457422a4c0274184b15ffa15dd0f8a1966aa4c1da28eb5437fca793934eb4d355a0986a0c0f4fb755aa52d056035f89280309b817ce1d555b2ece745d3765e54e44c31bca8cfdd6aa04a0cf6d70c347a32b0b34102cfe40eebdcfad62b9f61e58b6b9f5b081fb1bb3f73813eb9b62f259d0c948e547ea516a140000000e114e81b1b868f31e698be535852bf476f00e56a84371e6a0ec88920b8015bf0b2550b13beb41cc0b979b16d5632d37ca9f143dd41df3a6d5100d6630a8f2f66	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000009101cf02df8f159fa2740d49c73ced2bbc72fe27911cdbadd8447828f0c2df62000000000e80000000020000200000008bae32cab4a7d2d51cc078f8d5806c3347a52dfa4c2a29e57cf482465a5fc1432000000048599110f74c21eecf300afd9d798edfcf0949121cae75f54bd374f11edebb154000000009d7d9d79ab7700dd5d36f21292f6d881bff543e55ed317c0906db224d95416f0f2c54b59425254d6299630cf4c20376e36f5564413ce5f19e2d006f0be52df6	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c030c8636b46da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2224	1732	iexplore.exe	28
PID 1732 wrote to memory of 2224	1732	iexplore.exe	28
PID 1732 wrote to memory of 2224	1732	iexplore.exe	28
PID 1732 wrote to memory of 2224	1732	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5982b60de9b4f4fac0b76899a7ca1f0a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
93c50a197df0a740640b38b40b61ec9a

SHA1
c3bf0aaeae26a985fd15e7fcc461d6de2f2504f7

SHA256
7f1be7d7787e019dff079e76a3a1cd257ed294ffa9172a8187b329910184a4b5

SHA512
63f041c90a68be09f9a15c01025a7138506c15f8752caa29ca2e85516ee8efd966ffefb54549196103485747e57708432e1abeeef3960a11a97ea86f2b947700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e841149e62c7c0158eabfe059fb4a87

SHA1
e658f91043ccd367388cad9a76227cc2c342c58d

SHA256
959b97d0a8240aff1cf408341dad2e58f259d46355a5dc2b370452cbac42f41a

SHA512
deebd2fda18ce66b22108e4d47856c31c8b36016bdb99923e83050254eea1250b2ada38171f2fb68d39f7710d84f6f8daea463929858bc5a1fa81dc7c12e287b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3de748c1873344c725f4eefab3e8e59

SHA1
698beea11f48d80577ca32f6f7569d55271844eb

SHA256
3b3af093b8bfb5675c2033c52524caa83f96480a04674c55477d964eca1da8ee

SHA512
44563fd7a0eb71e4ecb567733720f8d532281294e0225751da910e46d97f92dd8cf5e0bd177c37a41755fdaf20e58b1bba7b1df290f8b7490a9e69180ddf6206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
518bf5911a1eb1b46bbc495ece1d6911

SHA1
cc9bee3ca6da8bbd2c4b863b54bf9085bc2831d0

SHA256
f625b950642c819e7a1d1eb474fedaedf0d185b8aab3356be0c7e1baa76c440a

SHA512
245c33882f1920d38a19b34b93db22e564c8955690fb6f8636bad59fa6f1d9218e40ca7eb1f8b5f3b82dab4ab60eb0567801579694dcc5caa1a3bbcc768fa278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
040a156a4eb6b645677231ebc2e0d6a2

SHA1
f0d5c771fba6cb12758662e68bbfcaeccce8b6db

SHA256
0e390a8a859887ec65d7b4fc1e5ec4d8a370b36b59cab09561842fb41de7fe9b

SHA512
a5c6faa55625b0a75c8e414cc8c0e17ff65d44a570c9ae7a06d1214069eb7175d5fd3a9857edd52ca73bc85bbc0048e36c76ab55abb700c2c98aa725cd6fadac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7be463f0b8668d50742db54549a992f

SHA1
8b0b761d1cc2692a73dfc4a613886836246051e1

SHA256
3080b6b1c5b1529a0965f087ed44d46f13aebbd1be1e963bfd64e1af27479c29

SHA512
fe022da4ffad09167b10daaa286391c3d68fe5e67809a0876ee8c5e7bc949638ba66f7561dbeddef101fd3b7d9a55428542af2fc129c57bf14ebf2a8673a6774

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a737979b87fbf67d59acd430bb0860fe

SHA1
865e92a6cf647125ed8659b96108e41d8069c30d

SHA256
84083f7b4b3d88c3a4240cd875f212b85e688638bde392e70c7011e8984aaf7c

SHA512
f9d48407ee797afa8e78f668a2f7f183a8964bf441defc4d97aa2c602a47f664efafad43cf75de8048b874fe1a6d01fba35c64c349beb011ccac48b39d17555f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
356d4d4172ad68598867adea6cc712e3

SHA1
54fc1c5907fcb1bab9cc59157098a1074f5312fd

SHA256
c57d0c5f20c575a79083cc2651af83f5b5d5e9ed9b77e90e8833ee91c4ae85fc

SHA512
bec53fabe70fdc6cc984e87b9b39d27716010cb41230597aaff239de9d71bea1b4383bf4140091d259af26477f7550aa899577db77709ca3174ca21386497e7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c11b6fabef12afdb628d03030388141

SHA1
1f2508f456dc30e8275b345847ac654c2b63c4d7

SHA256
836f5df85d2c307d591b4a2587e5b91a14b24fc9634285f2d3e29739d6583e45

SHA512
7d5d06780ba8ae4869f0e522baaf1922074e56373856b151200293ce1193d8d65ecccfe750a02ba5f17dd2a32cfe42bfb8f732ece064863cb242da3e52977db3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec81e9514e82873070d65dee0fcacbd2

SHA1
fd48282fdbb0a595387210f74088c82bcd186dde

SHA256
b7af06b48ebb05ba9c409d98eeff96a6718137293f2a2a5fadec41bf3aab9350

SHA512
2a11b4a31ba0996dacb25ac60f7136941670655eb0edb1df541ece8306602c8a4c3aefa724acdb5610712a0a05c988af1c9bb1bbfd98bf4651ac3f76db4ff402

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7a34067b66cae5dd6c20e86321b66da

SHA1
ac63e117fa27ce06ffa264fd29fca27c8cbd9e8e

SHA256
6902f5f55793a0405a0fb490390f2a56147a6d9aaa92a70e720c6c26ec4f5887

SHA512
e0a509bbb30a3fcac7d4ef09af03dfce34f22d4caa82544ae94243b35bd3baf26a44aa59727decf817db1f7d4dd084cc43f2032cafb2b219b36e642fce41b501

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
588f47506f004081b5f4b2abe34b525d

SHA1
ef8e7856d2f4c438b0ce7033d00aa1e44061be73

SHA256
a0e6708de05429710afe2b19a3d268f7c6c5bf46611b94dd4b659453a69e8a64

SHA512
d4758481a470f4f4fca0600dd93858781dcb5c88caf556413898e3dad3b5ffe8c35794e40ef01ed9f1c638e2c50546a2519beba133560489098a4b5d2c3a058c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
801a219da6647079d0c1691f49f3c0e1

SHA1
4760cd27c2330d0171f78f2799dfdccbe0f79baf

SHA256
28707ed04ee38b211bfe2209fd7241821c940b064faed4af02469fffc6923595

SHA512
f39bf47a8a50c828f7df50cf26864d9b5f06f322c0271a2afc0b78b08aca7acb080d97b02b12cb376b94d7dc67a50096af6b213efb7858b02cb4baa3e9683aa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\prototype[1].htm

Filesize
988B

MD5
431da47a6b8e30bd7d01fd28fae83cbc

SHA1
b111ededcf379236bb7e88500e6c3577500cf465

SHA256
8fb876fd7e52699fe2c6f1bbc8e70552e06eddd813e9e5ce165fea3d6c354c9f

SHA512
19b54aa7ee9943ba2e33b3f275d294d882c76f7e44115e45de7d5d5d860e992e297755512436e9e28ad9be201de5d45f8ae498c675d8f413dc2de21127ec6498

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1AE2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B81.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit