feade7220f2be680065e55dc35a9141120992f43a6c559ed127875ce73a0aba6

Analysis

max time kernel
134s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5861f8d3aa62606b78546246e5ad1308.html
Size

12KB
MD5

5861f8d3aa62606b78546246e5ad1308
SHA1

7c0628d35df9ccc5e472756970c49acad1af5618
SHA256

feade7220f2be680065e55dc35a9141120992f43a6c559ed127875ce73a0aba6
SHA512

bbbc8eb9cb4e21cdf244f0289f6c75aad6cd5a8b7680985877053d00e8b89ca3b503c66ef008b7ea69baeebc5d93322838d24f5abb0a72866075d594a4ea8ba8
SSDEEP

384:xy1R1QREDBeVliOoivU2ee7Io48LXXRlY35MCPRrMO77OM0TCtxYLuZ4mXYHbw9G:xy1R1DeVUOxcz+Io4vV77OyE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91BD4F41-B1E8-11EE-B0BF-4A7F2EE8F0A9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000001995e03cc7142912f5803e380103c3433dd091001df8761624d7d5ca5e8fc641000000000e8000000002000020000000e464f93001a37bd4319f5f0efd8c0b1b4d01b4d84c730d71935e2d20774ffa5e90000000ddc294f79271e6136c4328019082115cda684cfd5f15b492deb70ffbae6eb7d5801de22fafdf7c74859c8b794b297dc78ee67535df1775da2ee5e09f2191b1802a99c2a4c030e4b6eae57c050b7b3c93c25d1f409f8d2440cd05f67055defdc09b19bc1dcb16d0745e03c37275e4366ef0368f54534f7b68454fd566b9ecfeeb42b8c4c6ca932b57a5ef27e35622037040000000ab7b9f3c4102227cebe3bb3a0eb0cbd8cd32d6d0e225621e5e264b55d90dea653fa88edcb22878911cab4ca5a1d3199ca4c869696ac37d121a6361b0f7b37f4d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411294161"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000c4d92859099e63451a78dc409471e9861edc883a7da9769cad21a7e38c8ecaee000000000e800000000200002000000085913bf820616f3f6cc0c7fa9a66512ecf09ba760efe487e2e6f6a44e844539f200000006da51495c32080e7cfde7af38af9b673611739bcae89e05e18a61c664dc966a14000000022666e22a3c5623aaf1d5cceee0aa8256b55dab54faac06a45802a0e09f0cb2cc8b44d718bf54416561ad7d474c325ac78c2859b3a78c8b9c30056eea129bbbc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60660167f545da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2068	2296	iexplore.exe	28
PID 2296 wrote to memory of 2068	2296	iexplore.exe	28
PID 2296 wrote to memory of 2068	2296	iexplore.exe	28
PID 2296 wrote to memory of 2068	2296	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5861f8d3aa62606b78546246e5ad1308.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
505f5753d52b72c226e6f8d3d156c683

SHA1
5becb64a2f7bb4dd697ca0cafdd352b9d3d8ca66

SHA256
3b862a68df3a3853eb425fdcded683e57f8915ca3d53b630b3eed9b0d86710a9

SHA512
5be796c8ad14b40cbc26d693d0ef67735b76d74c1dea03b08211599925a4efcb625dc7012cb5fb08c74a9a0fe085e463df7dd49a30e4c85e34fca9b2d437ca2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da01c0970d54f7ad8a8c0cacea68033a

SHA1
690c2f6a4159463abb797353772f2403390ee634

SHA256
b725cff9cb76dad869666c1f50a5fcc2527cd4ed8c49e53ee5127bc2308ec5ce

SHA512
53586b865da05e56b4c6d350ca44c7a8e913647e1fc58d52d9a6f3042aa380078bae3f27133c46c94fb855342afc20c92656078214f31f4372ac55db7eaf148a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b82c38f07c13dfbcf8b2596c7c892555

SHA1
4aa73ec375c41c621d9e245ab21327dc77d132af

SHA256
a3cc0ab098550b6f6c9cecee4b32edfa7231242a6a2da95a86f442478e8f58ef

SHA512
7f488fe449e9daae87bc044067e69202a903d98f5b0eb5256f6fa7f37107f7ce48ed4cdf7fd3bd0a9faabeba7baf631e465a9627b2049ad93b082dda108d2073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73c293a83ac26241a4d6b846ef4c1ae0

SHA1
d9d4fc98fe81639625446f4754b221d07b608a4b

SHA256
73022bb4a1b38af23e3853e658a792349e1f4e7ba304b9731b7ba8d9e4fa0854

SHA512
d61d6336ad82eac5308df0cfb9e4d2aa95e772c504d0c3a3f6bd497cc79ade03e6d48dc9dfd1370dc03f80fa55ffe4ae363746cbae164b3839bf9c099fbc1bc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bb85ed9ea09477b79961600a6cde958

SHA1
be6219a453b10109c0595829a39dc5000abafdcb

SHA256
2155b2c5e04e4071b2726d3791313ba58542f0def1c7eddbb6ba5e8c173a0e65

SHA512
1f7af0ffe8f4f313fe06c4746c5c38fc9a9283014597bc9b35b3e1c68221593a5bc39afb5badb715a15a0daef32d39b0a67d0dd532cd68902cf3fb7a6b14c7eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81f4146dea018f39944b2ba0bd15c06b

SHA1
a65c2b3a9b06dc8ff7916e4c76004945f4a65d3d

SHA256
4daca92b6f5d376758a5aa2b45f87704d76196d87719086db9932912b97d767d

SHA512
8e003d7e3abee93bd16bb3f10041ca3c1e4ea80ce106ca3fba4965445bef6549dd78d5044cdfcd7328bfbeea0bdea75c72bfe3192dfb6128ad104d49b2d738eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7624e930bd4a2b69f7331c0211eaeeb

SHA1
a1ce3fe1ef8e7be76458da9f7c4863e1d875277c

SHA256
ebb87a8c4c0937ef048122497c13049877982b465ae97a0fc36bfee50ed959b5

SHA512
b89b4b342ceb02a7e65df2c1747d1bc9fedd6d5fec0dd733a75a5e4de56eb7a5c7bb27d00c8a3584599976f2dd2e5cfd50c77178e3fbee14f614b5076aba4572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a87829bc3cae817d6070c2136912f6b7

SHA1
5da8adf7923f0d3b885bd07c32a54008a14ed3d9

SHA256
f74fd8419c86d7168fb56d92207fa990f4c7c41a3559fa07b80c9acdb8e5809a

SHA512
52544c9060e6046bb287a4ae9a137974c5279415eeaf1532a10c3b858c74dc888a0977826fe6c79b1022073e67a66bccb10fadeddbb3e17f3fade38ea175cc99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df3db1447a3d7d650734e5d100b04215

SHA1
4b5c42f395a8f8b683365a6f7fd9950b17f13062

SHA256
53a75aade6ad0d3e8163f7ff526aa51e4985ea9cd45cbcd6926e93bc869869cd

SHA512
16ec7ebfbbcc39a1271d94162888bc314dbe259b38a01cd60de237145ead17901ff0446f6651f084da87daa2256140f6903bee8d8ca2aa9c339c657bc2ddfa87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13d78d3fa6706116befa17a2df186864

SHA1
3912f30562ac3724e2fe1b7a2c297d2203ad996d

SHA256
dc177e852473b0d30a9c4e49bb7a59fafaa87b7af684139983285a3bab0649a9

SHA512
d5c2d4ba65bfd470355445e083b48a3918f7e3a9ca3ab2ce12a43854960ad639fe333119716369276bb4141813d308686a561cfcfcb693a13a38a19096e62bc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
181b155ef2e4aeca3ec0fc2749bc6714

SHA1
6b93b6451048f9928bc2818dbe10202f6d1c4ee8

SHA256
7ebed08ecc39914827ad09eb51f94134caced640cf6e364e47067fbec9df1ef2

SHA512
f6ac4e8a5f4008696a4dc441dc78abbd26aacdafe3519fc8c5423af3e4e027d6a032f18cedf2b50c25e68929cfe7e0f2e25d3f74e162238db07110aa251da87f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f53391282d4fcfa0f53eeb7eec6786f5

SHA1
5d5acd70d2e4878413e14c46dfb93e59d14e2b37

SHA256
232f460c08a9e5dd129d995cf4ad87b96dfab2821d7039092d4e98deb926d39a

SHA512
2f6ca9005617f48eac4ab94eea5dab9c45ea86210b9fb5b6fa37cf389244b708ac3c611293feab3331bfc8379cf41365d318294bf6a814072c7cf55b8d0ab936

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81cf7d0d14924e891f93d9c93fcf4bd2

SHA1
cd45593da4f48a8d50cd24d1d4f76f0c87a4e0dc

SHA256
ca51c6b1ea63b27efbe83b2c61f43ea5942925ac1a7e67018ba4159776541654

SHA512
9a9b8688c94d60bb738123fa649d45271b1ef9fc972888fb7258ff538f03dd2e8927937472f489f8965b37ee387d743d80ed7fe03a28b7703dcbc61a264adf9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15276a702dd677eb7d816b5465191d2d

SHA1
ccc321b2d95dfe3b342edb24a8df2f8d62ba2b6b

SHA256
ae24a4eff04ac90f09d3dd66d3868de81ce7604cddbd8e1f6953590537df77ad

SHA512
0fcfdb16527a3b4f83524fdc0528820152b823124efbb28747707b369a51c94a272b78fd76a931726bfb5e1836205e87d7aa4a4b60ef8144ff1d2288a1166e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8e75e1e3361fc80429b606f797dab2b

SHA1
1700886e733f0a1d71cec43aebeb6d26e340b4cf

SHA256
828b370088535bf3c6f5cbc55d6d29472f3e00c27b44c986ef8f83dd820a506f

SHA512
0fabc6ce8aadf94904ba3da6700b58978f9506bb2db4e51a78baf422888a8fecad33134408f9324b5029753fe16697603607be951f7ea580398b5a740b065590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8958de61be2b8a9b01ba62ecb445cc8b

SHA1
c8854da23a894eeb2f6df122cc16877f6c5311f5

SHA256
739902ee22fce2b951e3df37fd4478f6b033e7fbffbc352aa94bbe650d35e8a2

SHA512
497fe544a5dbe7b17c841e4141dad0d405b637be05643447d4bbb3f8895fa690d4c6482778e62a4e2a2cb09b7e30e85f8be1fb101226595ec01e6213b7a0f055

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4FF7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar58C0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit