0a74543888a8ac59f24f3b75a327bab2deb275b6372ce2caaf89924b600d8916

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58c59820462fc8e3e23510b9fc35e7db.html
Size

24KB
MD5

58c59820462fc8e3e23510b9fc35e7db
SHA1

8f99e4ae06ddaf9ceacf7c450a58b5d4d69224c1
SHA256

0a74543888a8ac59f24f3b75a327bab2deb275b6372ce2caaf89924b600d8916
SHA512

c839280e8350483bc6c11aa3ebbfc0172f52d8309670203e8a372fb95d45c56d048fd4274bddec70c575538febb7e2392612c85ab5758ad17e0b81598a737d1b
SSDEEP

384:anA4ywzm4p9wKjztvukeKXXTutwNr5vy/6LIWQQ/U4cR1LeeIYECdG55LkuxOk7X:y1pVtWkekmm1k61k90t

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000022857880cc739999f870cdd303c77b34d791d10db0c28d32570d3ca3b67ea764000000000e80000000020000200000006c4d176b75ebd95a90026fb30a71a8d52f5f600be84a59eebd5fc1b0ea9e8d7420000000eb245a20b212cd39c37bf136d9ad39d879768f00943ab062728a8ea686407672400000006b18427d4e16198c1768ae467298493b9a378b3be04065a61cd7f71b252a7c26929cb6f98c1a525f9afae7474ec4b11b342cd6bfb4ac78337fd5ff975d06cfaf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20cd51241146da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4FC3EE71-B204-11EE-AB70-EED0D7A1BF98} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411306076"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000648ac69b998d7cf4a4b5a83b3de95aa8111eb2a24e7372d6f2a3fd95403f4440000000000e80000000020000200000009d7a2bca1dabfc1a087ac35c393420af08eecc5bb19bb99d711d686fafe0976d90000000cbc0db54d7104e0d00882dcd978dd6889090da93c9e3b31db39c79b27d4c4d378bdb8290272b011ef23e79c2e91dc3509afe3a203628f51043b52e21052271b4bcc53097b9df7b162fbf3e65af1cff0eb6a88c76ebcc4db6bf62d58146c8ce0c696640d8accb84bec2e535415393f010ed5bf047d326eb71a80881594214b47210c11586fb172dcdb4cfc071176a895d40000000c8d8c796e721432e927118e15f0c7ad46aefcf769ecc15a6624056f03bd4e5f941c559e96f1d15c65872456b625764c9acd4da192f3fde9d1126f9f3e6915e06	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1224	iexplore.exe
1224	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2476	1224	iexplore.exe	28
PID 1224 wrote to memory of 2476	1224	iexplore.exe	28
PID 1224 wrote to memory of 2476	1224	iexplore.exe	28
PID 1224 wrote to memory of 2476	1224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\58c59820462fc8e3e23510b9fc35e7db.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67f67672661e4e2ed6f5d69b009d7b39

SHA1
8278bbe12d2068dce5bfb31630975379d09f34ff

SHA256
2565fb5b87ac4546b49d1f4595150f962d2633f1d659bdf9291e0c6513562285

SHA512
ffdfcb7938d3fed0d53eb0d738aa4072780ed27153121e84004ea041e250de37c9af8b7c6aa573654697d77c4a4517f62b08a94d47f4b585852d793a93397a44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
962a8f8e374ee80d427f068a9f954604

SHA1
da2caa1bcaa09334c2c8f649ac17f01d8796fd7b

SHA256
5430c6b3033db1879dbb6f7c2cdf1fee4e59bf5015232231790ded92e701b7c1

SHA512
9011bd09e2c9a567c7e0fe007db0fb14b54ba0d52c58eeb201a6f5bc28669a44b554f19d629b571da5c6263325e19ba8517822315b6ff3aef35c1421ebbf4378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
377424166a68a6cdbab51349bb78b6ac

SHA1
e6c710c5671ae7e5ca7a19aaa0a98bc393f775f0

SHA256
0e4663a7d62bcc4059faae1aa868d47ad3ca1f3a8c283d8324968d8a474221ea

SHA512
6fc5564831485c53454df8ea6ff0576fd23d460c6a22258e0203decba918fcc6807194acb1e8b9b466ebb8fbe10a1292eeb76cab8ee6eae8b87b89467e0f2667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80829a760b9d34007de1e4c1af38270c

SHA1
3b6dfb178415b2511ad21e39cd0681f90dd75912

SHA256
460b99ec2a8f3665dc0c2da01546688aa9249e206a8de8ab5765e1f5ad97ab33

SHA512
f8e5013a12c9dd3ffe9ecd2b782a717a47bd9f21319a84728a038727f0d1a60381e192147ca6296e9ed3db6cf44b1a3b4be1f52f14cc20cd0d7be6e63b39fb27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c11d7b130a10b4651ee9879aa0be00b6

SHA1
fbbf2dff7c34877363acc074a069536d03b846e3

SHA256
e4f7aeae664cefbf5847e69de70846f7f47a8652291e3c75bbead18717f31b0e

SHA512
03aaf47c612bc7bb84534ab6262066bc16847b9daa4c01e56cf4098565cde099a8a81156da9eedae6768632f6d2a9408bdb5f278a2d36c1dd3324d08e1d51d79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6190cd63cf8b2dec2f47f6085bc58b76

SHA1
4296d917b824ff37a9e4f6fc423bee9460cb86e7

SHA256
1b9323738dccd73898eaef1e9dc06f99cd5bce69c029c8a2de49cd22685d2e3d

SHA512
e820aac5b49a4404b0bd6f496b2ccd55a2d2f7276387efb040d5801fd37c06300da5586c589dd887aed7baa6fbe98aec28e224d6d1ef7d9789220e0d9a086b74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8165fe60ba53267a75a6e18712778ee

SHA1
ad3d496664d76fd83f754aea25834810a92c1d11

SHA256
397fcea4d356af350b7de35cb2b5bb5f90e14eac61fbff8b9f6cff6366d5f015

SHA512
2f9892b7da1d3c0221657e75dead0449a15fc9f137ce6eb9ee3892a1d7dd3b082eeb41e972bd6ad92f43fef115edfdddf478e57dba1eab7801517790d808b198

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13a30413c95ff9e72a0acee86a8cecda

SHA1
7e50a9dca92ff53379eb7f0a33bcd7ac4ce0d5fa

SHA256
2db8762aa7404ccde3c1b4cc213174c2f4ada2aa5f0096edc49436d03fff7dca

SHA512
946ed77329136cead0baa59ad48ca546fb9c9a90d82fa97aa602127c77408321b30022d4e175439efb2f90b56663799fd535fe62092ce4ee0c804c664b4d6c6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca726eb5fb14bd2f56c0faaba19442b5

SHA1
99c35809e63ab655eeab7bb11a28fd91f0ec6307

SHA256
b37158a84e614700a3a51947e1b00afcd5df0f883b7b433f0d2d812cd5f2a23a

SHA512
fc78792ac1b1a0e69aeec73e9b84d575293014da64065580f0d42c1e2d1dab572abf08d489d83d0db23141e48caf1dee735d70955105be69d57431a9848d665f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97332d5d40b9fdcaa95116c5bbbfe12c

SHA1
4fd4aa0d1045e8dacbb220c06fe77e19eaa55f0e

SHA256
0204c113cc48bc5c7d27566473b6b8d49ad303f13b46064b863b3a22cb44320c

SHA512
888c16f11f17f02441f9d953ab309c50bbc9c79f7f9669722087c1bf8f124a1d35974fe553ebefb95674d8586cc7b10c15305d1567ec9c950e479074589d6129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11f6ded0341697cae7ce4a08cca48ef0

SHA1
88d390ac0139dd55b487c6efc18f27001cdd1126

SHA256
07a8ccf69344c0abc5ed6dc3e421d3662078f0ef73403081d20b22e3b8fde2c4

SHA512
6ae48388d99f6cf152bf21e1653cb70a31c00ee7aac343e8244b162bdd84165f51c70860fac7908844e387a593974447fbaa69b22a30c989c77b9f22921f22e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57f09c15b7c01da1eba45e73c7fe5d01

SHA1
3b1111b0509d7837cd48d0d75be70a4a82a8036d

SHA256
c9a3ca90d06b1d31793486db0d20cab43beebfadd99fbf5b9470dbf110427400

SHA512
f53bfbdc5254d64ed08dd005a2c831671212e6b2ed6bddc6b419630a5341c69d46e85b643545ea995ac5384ab0d4a12dd71fbb0292ee74d4ada567667c6552d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
134a432c1a6bba7a699c137aca06c0f0

SHA1
2971c327e3ddbdd2d90b1470598e2f9f611ec446

SHA256
4f6a3805cd0eaf54cb6b21e37c9c67f507f595933194ae010946213898517123

SHA512
f31ad36052f2e74d97c323366f9bf2a195ebd5220b2e68bab9532f7f2fb998a986113212a614b487d588c17b625b342f11f39f22aa4a08b832b0fcd4a2fb90f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d19b6e059939d8d35a29b5ca192396d

SHA1
97b6c2b6e5d79f634c6e286e0c26bd65ca80234b

SHA256
1633d8de8477abf60af357c3cf9fb9881cdbce4c2947f52cfedf82979fd90085

SHA512
41c64cb1b7906d4c001b9ba3c51197004a91b308ba8d827c9d6841d373ee1a33a857e67f95ee3f351ea536e41543de1da3d248fab93769631052d61921c61455

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2668.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2707.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit