a27ac9e7e6b3db9b72ebec22956073f18d402613db20f96885c8b33af9f3e744

Analysis

max time kernel
119s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5819db6da457f9017a3488b4828418dc.html
Size

432B
MD5

5819db6da457f9017a3488b4828418dc
SHA1

063b5660753cebc019df7353fe929d0fa57f07bf
SHA256

a27ac9e7e6b3db9b72ebec22956073f18d402613db20f96885c8b33af9f3e744
SHA512

210b75b9341f1712d4b073437e318d05a6026ae4e32e8a1e2ee0106ce51d5f2b3e3f5f26fe843d95111769972f9ade3cb587ae9bd18da70b1275ffa2be38588e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400f689ae145da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000005eea6caf28d77cbd85e424e3a1c9d78f1b0bd08771b51e404caa1811f1a68a69000000000e8000000002000020000000518cef6461b97b245b0da001bf733f5ef068693e2fa58e27fc40ac53a9db4eea20000000e4df4d0395bf186162abbf1edb28c293a70da5d2a419916769b49eccc907175440000000914970009106eb02ecb8c95c61400251efb1db42be409d64dc41ca2847cae59be79c5a0949e31524105abf44650c27902947e2ecd9a78e83fdfe91753abf4273	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411285683"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000486054ed39fe5df8a7bc73b1ed40ed5dbd9885de294839ce1dd4b72cd7111f54000000000e8000000002000020000000f578e5a28d40f44a6b942fe912981344f2a4573350cf6347a4a38ea64240dd1c90000000407d9f8f2def6d089e2812762fa9badd948415d3747ae03dd517057aca69dcd4155bc07bdaf8144501757c2e2e621a2aba6bea855d7362384e1aa027453f014932b4e81794eebb4ff7089bc3905440a6f9dafde41a965d64914690476888e8862147469b1eacd73288c9cf8a43d7f4dd41d908dc504ccb1c3e6b210e84f744584cb766f74695fb7515818b7dc8b442a2400000003df1aa93459325575c7a66667ca769cc370df72bdbffd292a1900e4209a64733cf1c644c2adc96b75a08e49a6ed0a079bc555d4f56bab4b12af6dd47ae51e313	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D49BCEE1-B1D4-11EE-AA86-EE9A2FAC8CC3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1928	iexplore.exe
1928	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2652	1928	iexplore.exe	28
PID 1928 wrote to memory of 2652	1928	iexplore.exe	28
PID 1928 wrote to memory of 2652	1928	iexplore.exe	28
PID 1928 wrote to memory of 2652	1928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5819db6da457f9017a3488b4828418dc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
15f09e8149b16caf975d3b3e4f43fd10

SHA1
858a973b50b3017a9d28630d62000f42ae46f38c

SHA256
f986478f26e77d8b5ac79b1d4755a463e3657236393200b1c60171920da21746

SHA512
a8633fc8ba12a79ede1019fea187d4e67b1933628a9ecf14ffeb29a93728d6e9ad6dce94f33b0386ace4d3561ffe1d060f13bdfbb04ab1b776a3d4b3e36f34fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b39ea286940744bec5299e93b9d64ea8

SHA1
8d6a4f684315177980695d80503f206948e5e3b4

SHA256
b2bb461ef4e1c24926c56d087440e556259eca416762bbd26006f6a5930bf52f

SHA512
993d5016568dc0e742c07f4ac4022e7871b9a1acec8617cff05abe27dde911dd90f0671d5bfbc3c9623d63f730aaf580580825717ebf5f4e14acab3f7525dd90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ff0628d8d62eb37d20ddde9774ebf1e

SHA1
be23cff169a74b1291c7a10be841c8fd8b843c4b

SHA256
36b9d676a5fe91e0271e501d5160344f283fe34604c143a0ca69c7115b6aa7d6

SHA512
e7d23d90ca6acea062a151e7c0903e5d39702549cba6c940c239f7a3f676289b8a420b61dd116b90d44a65416169de771d373ad7af437763dd43bb82690ccb97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
827e1aeb30e377de3ec0903f4b21ed96

SHA1
266e0625a6ef232d899303cb621bf300688669c5

SHA256
3ec33ed004facab63b86993c319df1eb981d57d68e37d1a0daa243001dd4fe77

SHA512
654c43f7b560380a4f84ceffb7b9e5fd016de169ee1c63e85ec881cd71828e0f539cb35eb19d2af228fef403a878516178928adb2a98b2e6ae918ecc30417f54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6fdd29b370b658e27af1f28bdcd32fb

SHA1
63a3d76be33c3dc66c36a9f609d38bf7d2d2a8d4

SHA256
9144e2ebda1bfa627bdcff69b9329f57ea11049866e29a9736460a688c159c12

SHA512
1f04b614068548cedb886a4ec640351c50bb4a5dfd388894ac95b2c23aa909e1f71dfd363a056be93ebec39147adc399555514c370fe60c32f8d9699c462f8a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bae04d30ab550e09c47bf7c5d606fa86

SHA1
a7beb06bd12bdf4e88d8245af2d199aeea15a36e

SHA256
aac89ee5b2ba2f49f33b4bea2f0b452a9e755aaa2de7d0cf25b4dd7f34133b26

SHA512
4c8984925af39c22498231a3cf3d9cd5c5983857f4cad7056e6f0d156121f84db86a7c20b97f3709eea9d919d5b7423e1f4a5edcac775200bc4d51c870ac1d9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24a9880b60ddc06052c22bb567fd8c8e

SHA1
1462be813a596ffbca46ba2d30a98f91cc7e2142

SHA256
d5899a9de5cb077d1b49db159abd0dc8c7025c28bcaf929a470b8f26a8d20de2

SHA512
ca82bafa1f51fc882d3c5c5c2cdb00f1530b3fc79ce3733dba5b4b934d2fc5076b8632ce738db4a6fa51ac99de2a0fbaee52fac3bd2f3aa2e1eea349ea9bd9d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
943e8f26e4b3cef0780cb22d2cadfee8

SHA1
88260077abeee233123eec640846265561162bac

SHA256
3074ac905b0241ab6455d20410faf30fa56943dd02a2f30147ded55056225e8d

SHA512
94cfd91149337412a6237c80b108bafd5d2b9c142282446640bb01130af231ef4ecb709c0636b80116bc409912a4ddc88b03b42f53639f6b581c0426f2a8bdf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3d6f06f914d5d9eec4cbbdd2c06bb58

SHA1
3bbd6472515d485a0600428ca558de5a60c11d66

SHA256
3a705db5bf175d2c62f4d64922315f3e5c942b55b44e642845b7bc825846e9ca

SHA512
97eb8d68d4414fc691db36c1de7105a481f13c061f135f07d6bb16714f007030f8b34d4f023c0859ea142c9e83c6a4d9beef603706a560ae11cf0feafd8f0edb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b966bda736e9c3654a0e8b392bcd4409

SHA1
40775c407fab05dd9d63897a874750ffc366f12a

SHA256
1d6aae2e0eb1371ca8581635b6c818e62f6c8228446408f52e10329cf564ad34

SHA512
9539fd781e3ae8bbb0f0e87017cc59f4a36e7002e0e254856d8375aca5ab687bfab5261260c3bc5120ea187353ce21b683d5afdfb056b1c115d07d1a99e1bf97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2b696b027e03488c78a5685ceef15750

SHA1
d72134abe3c25d39e0b4aebd937551530fd5acb9

SHA256
c0d125039ae877bd09dc1305e49715c7ae40034a8ab2181a75f9ceb221a3158c

SHA512
fd135d424275dbd3d044f5519252f1725d0efba24ef18c9591d6bd122892f57ebb7df4bf734002e9f22380f61e5a4e73445d423dc8c8f14043cb8670a7f90fd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
20c2a76e1567fd93532bac46d39fcba6

SHA1
8294ac399efd7e62c0f176cb8e5c94fa5e4beaf3

SHA256
ad4734706e7a2fe107224a57b3f235b44a812f0428ddc98d5cad0fa88476c25d

SHA512
fa2e79e566f21ce73db74e643ac97c5f886c35fdf11293a95e650c23e364750fe07ad00f9b1dcca28669f5807d29abd6a48b8bd7648abee4bc9aef36c36b329a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\b5orqwt\imagestore.dat

Filesize
1KB

MD5
49863a6e368d17683e8ed331f78d3e48

SHA1
fea3849763893134cf19593f5492598d312e1c9f

SHA256
7b76d0d20a3811c9605e34ea82f52f8b6d1b1b6cbd4b72efdc3633f5902a3287

SHA512
ea8bede51a5dff35a06722465bfccaed61c506569fc70838c525a569ca70c486b695074cf14de04662ef88be3290e1a620dc6b0779aefd375b11ee4a278f4bba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B76.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C24.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit