e7a77605bab805480e7ea02326e298cdeba9631ddb31fd587611ca7f6935f242

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

599a8e684cb056be6e6e990ae4e54f20.html
Size

7KB
MD5

599a8e684cb056be6e6e990ae4e54f20
SHA1

5502096e50908abc36f5dd4ca0d37d9da785fd45
SHA256

e7a77605bab805480e7ea02326e298cdeba9631ddb31fd587611ca7f6935f242
SHA512

bc12d4e6c97aa70f91f7e6ae72ec47de8f4f7df41f8cc1d55ebf05e98f35419173b82bce1356da55726cf8f13ad164312c1ffaa8884656162ddb47d60c3f50f0
SSDEEP

192:qaZ+sSN9aY29LTpUEd2K3STUueZo2Gtttv1eQB++skmhHYNFiINu1VaYRQ:qaZTOqTpUEd29QueZStttv1eD+skqHYd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000046da8f985c1f8d851c086c67d5f5a57348ef19d6f94cd7ea95d32ecbc68d97d1000000000e800000000200002000000024dbe9a5b609df7563fc92a1c8aa379760f45539677f2b5ab2217024712823b320000000f04c8ea3363e3f5e451f9509d2d8d393e41063bf79e539f81166f33b03cde19440000000aa08d008f1eed990a389c5c19af3dee7eac07757aeb313130702e75a4474c983bb4b9a1692ca3028cb459f75f09bdd491896b3af090b1828b42b29ff455459ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48024771-B265-11EE-8CED-6A1079A24C90} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411347726"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80f3f11e7246da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000d903a5fca0cc03363c2736e3ecba0d1e4a79d53280501690169c74068c27b836000000000e800000000200002000000003a95f4415c8aeefaa08cc10ef1efba1366b90ae9eb8008843e27d1403bd4cf39000000001f58071efbf5d9112077a82412fc7fee5da05b9b750549dfc29ab88d6c20fdf2aea71672d4736f61a36ff3229101e5ab388999a119de3080a432506695468979aa135a41995954be73d692f8bbfbc5b1c4d83b209d76f983f93be8bdf643f955fb876a4a1b3fec4ab356b497c96784bcd0bc62dd9246f23f3e6c5a475afd863ab7543b4ec2e26180e091b0007c161874000000008e374e5f941245cdcd5b171bd18fe590f2bc223c76fd9e8adcbe5fdec8d5257d862dd6b0bfe8e198a6969c531f902bd5092d35b0b882f3bce2282f1ed8fd79f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2788	2884	iexplore.exe	28
PID 2884 wrote to memory of 2788	2884	iexplore.exe	28
PID 2884 wrote to memory of 2788	2884	iexplore.exe	28
PID 2884 wrote to memory of 2788	2884	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\599a8e684cb056be6e6e990ae4e54f20.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7e204d630b8ffb315617f1457358e42

SHA1
7230b7b2891e8b54a5c507195783deab7cdb08a2

SHA256
c7bf9f2956c8e49a5c1afd23193ff388713394a8bfadd8d9cc9e2f5dfcd136e6

SHA512
6cbef9aab648f8cc45cb8d176a2d169d3c8acfe55efa9bd1de11c78349441b1ed3a671e16d0ffa7a7936a1e366ff2bec26fba8e95e8408affd1596170a9489f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76be6b53749ff722684662148b97a90f

SHA1
74ceac37f06b1590c7fd574e72be6c8927ed1694

SHA256
4cde45b1fb2bdfdacbbe7ed3270e559953a8d659161ec0390fbcf0e44a364080

SHA512
477db7a52dda428931e0017bedbf4db699efb0015feebcda39f184147cfc84f0303764a78e3af99055723e51a726a199a353caac83b8d9be2d0347b68df3df54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f44ad66da906f9603ecf4b26161847f5

SHA1
bf736dbd2adae2f7273182365fe493f2d6ec404e

SHA256
333411f3c4c46876f5f163f87d86bebb0ee55eddc54215696a77aa2bfef27260

SHA512
7eb14e89a14b1911944fc9e239f1b01412d2f9d73acffe631f76a669191a6698c5e1376a914cf221e2c1648baa58f187f223d75a54886f39a239ab024bcc6cd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
164b6606192039664844807d4cdfa7f2

SHA1
290b3b86b397a07ad37d9103f95f404e2167b878

SHA256
257414b3438873e4f452f3207eacd4fa2bed1b5fb2799635c35e2f957c86854f

SHA512
4ba5f29ef6d3854a9a2ec67303c7b0b3765dfdfa6799353b85cebb7c6c10773b2477a082f56cc52ce998e39fe3c6719286e429ffcd4ae5a9ee4748ae83e63085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31a604e1d76565fc43c907aef87f3e62

SHA1
6bb2aa7129f1f8dfcd76b04f86493dee861f7e4a

SHA256
59e60862833e8d3a22174acdbc93f1998984cc88238a4ae3d0e585a28a91cfc6

SHA512
2de9d14bd5ef2b4f77635719969c86e3a757651b6269589c09a4de6e12c71f0c4781b4b7c87dbea0468e3d2a248ee9a0ed010d416e2feb599ff78806696ff5dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
113108374f5cf3a3ebf2eeae9bbbd3e2

SHA1
8f7d48d13d86ed9056e2f74b3a28a6064145c7a9

SHA256
1ee638facef76eb1944e5328abbb905fac333943dfb69f8f185fffe32897d7c7

SHA512
4ad5e92d3eff4daecd5240d7be7587bbd8bfb941ac34c7bcd442ca8936a89ef7cd2959bc997af27711e236276cdd9edaaa0accbf930e74030324bc5fe52e2066

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea51c001d91881aeb68cc4db9d9521da

SHA1
f40de6ca8dec98b0ba9406fb43c4ddbc550e2bc1

SHA256
2034ee881cdf46af6c0932d5a53c18fb7c18d7b8d9682866c3cdc1ecde7af61b

SHA512
d5e1bb4ef75cdfced3b447718ad0b84e0a90aa04d0a70b3d9cc017ed07a2fbf44bfe293b9b69acf82b4bcefb9d7da3714e7ae9339c32ecf467eed1092aef66c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f47b62a19a54256abf2c8515a322e7bf

SHA1
6e7acf05e952e15d67aacfd8e4419afab1ff5271

SHA256
0f11aec3e95a8167ebd32cf694f266ac94177c7a6a681a49315e8df401decd57

SHA512
b5c05e4a51bd1ce5e8b3fe3191ac3fe7646ef2df51c79817bdcf4a1c70571886d60de487120c24366e030a8346efdf004fc018cd93a2bab97b997a8b7e6abb23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
291633f551e1521e5ec58a1f5bc5c742

SHA1
15ecbde8c81e06b2468a1b35320656208cacc22f

SHA256
9e3c9915138f6f0e9ec81ec82fbb64f9b86fcd7e883ee22d26186229fb2b984b

SHA512
d6fc14bc6ef973729eb83bc2bbc04e49469749c4e7dda4ad6ee6686057da54ee6c7c540e9bef6844f05eda17abf56d1343b9b6d7623d328703d64de456588616

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b9adf8c8d728a6c790810f5a1ee9a42

SHA1
97e80ccd3c2e5d13778ed60b1b7c90193ccf86b2

SHA256
88c3cc9643bc5dd2191ad34855b39a43aeda70a54fe48bfda6d96d19e5808549

SHA512
c77a9201701aaa094fbd7c6f4a084182d85c26ff5f53ee7427dd8d71608799da85127a2d2ebf1c13c7b591b1ea0499b78c3350cbad873d6d3d609062266d57db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d504eb52d3d7aba79abf3294bcf2072

SHA1
c3a8a5e2bc49a5554037bb880c6100fb6c581b28

SHA256
6bace89cdfda8c85b18e834fce61f8dce6cc3ee1edbc3c6d8ff071865c5ca24d

SHA512
4f901d61500ea0381eff757e418df6d996ce0a4183038e51223b2a68786e15ed951f5f7e4b5cd6e872228077a3cad0779ebecdaa93692d5649bf89a1e407643f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46165842355f6f610edabf388cef7d23

SHA1
a235faaab3dd3d78dc2c42f10968d889b57f606a

SHA256
45909508890a1988d370e95395093c8a75f6c0ec1f680f23de76094a05d7f3de

SHA512
fc301dcc1395376fea6a2afe9073340f40d93d923ba267814a695a6bd4157965c55ba846218a0eb342dd90c3d5ceb0e263fba35e162664ee564e8e675dea394b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
498fdfa2978e18d2feb85a33fdcfc32d

SHA1
afdfa660479fb01e28acb5f05a982eb76aef5f03

SHA256
6b866115ce30240a7eb0fc2dea4f5556ba86075af024c3de42a5458c2b36c529

SHA512
49347007092126742a411f5b908a987dbcd1862abb79cec7d7624dca2dd6157e35ba4575c446ff66777134d40b196f931f3a4c470451bdaca4c0d54a8c77bcd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1YVWL6AI\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8402.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar84B0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit