0bcfe49199b220b98e620be024ef888d870b565184d8e3b6ea378c5c2526a552

Analysis

max time kernel
138s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5812ca3b1491fd301ab684e3aff1f6be.html
Size

12KB
MD5

5812ca3b1491fd301ab684e3aff1f6be
SHA1

f31578c259631f541138f5a4a7f176c0cd7ffc91
SHA256

0bcfe49199b220b98e620be024ef888d870b565184d8e3b6ea378c5c2526a552
SHA512

6523f3d15d70965ee0917b874543226d4e6fabc9f4f25e9b72d0f584a22e5876d72cc0f7f8de29769e93be887c97e8eb8ecbbe2bc387ad8fd4a3d65456594d8e
SSDEEP

384:xy1R1QREDBeVliOAZvU2ee7Io48lXERVY355CPRrMO77OM0TCtxYLuZ4mXYHbw9c:xy1R1DeVUOacz+Io4pV77O/d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411284802"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000ddf145c53bf089cd99731d1ce5c820ad4bc22435b9483a93c223ab129386ce66000000000e8000000002000020000000a8a22206e641fe56e2f8c3e7e244940477cf246e9eaf09c97745dae8f1165f2c200000001813047dcb54e6526d5fc985b726b292891efb82df9b88caea7f83f313e5691840000000d8d1ee8de46a32d2f170491491edbe841a78c8597105889e68117f2c8f153f285e02efde0444d783535c570ae76672760253b88a5edfa44b5ca251d967afb0be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000084ee990281a5c2ba3114dfdf9c6d0c744e9dbb1e03f8d184ca6265bc3a42944f000000000e8000000002000020000000f890b04957826921f3390606ce5171ce40e84c34fc43e4796f76532b7279ee30900000006fe0a6b9ff9d286451fcb00169caaf7530f8efaba91acd2f2c3fde684dc26693598743c533ef488ad542de29d67f55cf1a8856bb0f792e22b07afbcefa041cf5d52f61a61e558f0067e15395cec3d5cb6b181560fafd30548b9ac16da6d7fc17c4ff782be9c3eec3a79f41d36dfb347ce20936dd972fe3fd8d8c30867dad1b4d709d8d4b52337896e1368d7f8a61497e40000000ec8ca0962c20241c298d110411c400fa8044b8497eb5defa0fab47995420475d93aed59e74d4adbc58caa09da88b7e9d0d9145db79df59f0653814f45568ca83	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70389999df45da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C5160051-B1D2-11EE-8CE9-D2016227024C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE
2160	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2160	2224	iexplore.exe	28
PID 2224 wrote to memory of 2160	2224	iexplore.exe	28
PID 2224 wrote to memory of 2160	2224	iexplore.exe	28
PID 2224 wrote to memory of 2160	2224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5812ca3b1491fd301ab684e3aff1f6be.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1049ec24541fa5f37465c98a2e2b538

SHA1
cb4523ffe16efe54e798e6824e2b7c292720fadb

SHA256
7010cca56f427c8abffd0be17f3bc47d91f716edf70c3660a6df8415fd4daac8

SHA512
dbd4e312a42fc772810463730a6f52064c93a83c7fdb0095a11c981e7ccaee859b1693be1d25a03cd8049cd977e1ebdee90f23448cf7f5cd2e40b784d2f9208c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4acdff232a8940133eac5da887450e9a

SHA1
e92a8a6775e267bf353e0207371163c47c2e115e

SHA256
6372b9aef8d2ced694198a2e5dada3b6ea981da51ad20a50bf7c3128f9ea86e9

SHA512
7e35cf4ea7384d2f667b9b7a40a0a4393fbc5f77ab8378393f3266266e60569dd6923abde4db8022276a0dfbcdeeda9c78f14d160f6f2b521b950d1b7879582f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a85a73b6e80bba53ddd5f6e89ec3a92

SHA1
f643c67726c1aac5cadd59257e777504b35aed4d

SHA256
f7035c04141d6f739aedfffbb6c733807eacd0a31ceb2acaafe3dbcb2f361b72

SHA512
05a3a2be837a97484cb822be57df5799bc303f6cde0bb2cfac99505bfaacd4b487dee19eedf4ec98cabf3732a02ee70fdd1eeb563eab66c2d7263355e8a08ffc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e10fe6a1d9af6b1faa228357ea329a4e

SHA1
c01223df46309bd4f1b05baa5263eba603a63ec1

SHA256
38b9c6720fb543142d25907aa1f3dc446521825552191ad9d3a563f1beb2e14c

SHA512
15f307657fb1844bee76e9275b0fc6ae740e8fd4dbc0d420a1d39c0d94da114cf0c2c2d08fb6f907bfe8d3eb6e47e5c65396e0c027bc20e09160c609d9b8a362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
567a77469c99dac8de4aef02bfc93cc8

SHA1
55dc7add7440d934b53fcaf6d2710508ee0f126c

SHA256
f408e58a86ae09382c34ac91594c7ac5c1de7473c3ef62b88decc77d5c6a8ff3

SHA512
2ad32545ca42e39d547c5ba916d89e1554f2138405c90a88601fa941c83ffdceef1fb00f0a5681e54d682890f9e4b66f131c08546fdfc14ae52bd95f8fd8a164

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
233378973c718d8bdbff98685f6924d4

SHA1
b7c2621ba7417f687caf2f1d92efc2e009909495

SHA256
2b5da8814142347e10611ec58b19e7dab380addf1df19bac3b8ed128fc3b9902

SHA512
0d5801d550c617aeab529613f2dde5ca99dd616b233af0f66a030bf3a0cd8fc5bb547cce1cd731100e5186ede20fb8ab24d7cc78959ab6cac5ed281b0567d4dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
310aaf173e499aa4013e021354872b9b

SHA1
34cdd96a5839a3917c4d784b9b35698e67f6ae52

SHA256
c90b1100bbc68aa101d898433146c6e333a5edb2a5fa64454349bfc39d0192f1

SHA512
c22598231c8de0bb53668c73a36014fecda0c9fd156c2083cae0c849a5043cf86fa1b82fd3f7b4f8730308fd3a9876e1337693f3c6ec881e4e28c8311f28e4ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64828ff6eb85fcbdb180dafeee29ba4e

SHA1
3f045221554970c81b5aaec2d4d3e16bc7e8ae9f

SHA256
f3bd3171b172affa7466f2456bfb98b05929d0d48517f1068bc8869440f1452d

SHA512
ea099e04ae1dde50af43d67a619348bdf5285b47026ae65c1873985645b180fe5e2716c496c832eb898abd28ab3e1dd3e42c26c7531d8d053819fc8d360d0d8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e95efbc7732440214576cfa394d50e43

SHA1
4a7388b050063b8eba6d903d62e2c110be4753a5

SHA256
5b8d98a43662213ddc6534061d20918ad5f9249e5195975595e1efe98c589e40

SHA512
95644ced5d22883d44be2ff7638250c66d53046c8a1e3d1fbd277553e1fb5655282c82e2627eeee7541533c9ed2913a807cbbcfb96a28310730d0992b2bb09e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94cde7e8bda3fa2fd8ce47a147342ae0

SHA1
479640f96a3bcb8be6ec1c756a3f6d8e294de788

SHA256
21679a23e4ecd3b83d306ace6d04d5c0cd4d893f7ab668ed189d1ebf2ed88a59

SHA512
cc719bd843e30753f065e8ac4ea65091c649f9911922ffb6bddc6c119a7e91543f99c66b0e43e7a3ebab6c19cd41fc26503d5a28f8098f4a24891aedeb798b4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c0f8cf91936504599f46298572b1418

SHA1
03770388459a81a6d5a1dbb514a8055c04ec72d7

SHA256
2f6f0b3449175c5ccc78171696fdae99d4dbcebda58e2cd706e7367052e93a59

SHA512
c46e3180259d7970b5584a787516185ce9ede4037569410ce5ad3bb3185bc70a11b9972119c4b7677b98f64aedc6766486ccc344a3c3bc96755519c9ae40e23f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3141.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3163.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit