e8d4f4f27211e255fa1d09e750e0155d78ef5b883ec7e03aec866bc6f984923b

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-01-2024 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58e2bc07cee75439310b3d6fcacaa74d.html
Size

57KB
MD5

58e2bc07cee75439310b3d6fcacaa74d
SHA1

a4e45b48134bcff2896eddc99f49f20d83d1831f
SHA256

e8d4f4f27211e255fa1d09e750e0155d78ef5b883ec7e03aec866bc6f984923b
SHA512

26e70b08c15cabd5fd8816830563f7164f39950e9e84afa8fb2e45be2e774188f796d2a484ee35a5d75d7282b83622e31c901a1facd6c579a34592e2f3ab5027
SSDEEP

1536:gQZBCCOdW0IxCE0E9f5XflfffFfTfvfOfffffnfnfwf1fAfDfUff7fsfMfrftfJO:gk2A0IxLxXt3NLHWXHvfINIbqjUUzFhO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000007c83c8aa3f1a0c065da1ba68f92cc456d59d21ea99f880e26502078ef2f52fcb000000000e8000000002000020000000113bdd7dab371842c3a505fd27fe194f52d73d07c98a795e35e1ddf6a8e6e81f9000000068eb7494b60dfedf1e1f9e62fd8108e5bbb8702003c14471a1bf40ffd1da9e58342dc4909c742772041e321cd8e794d84658a9d365a7c4e4d553e64c4f9ce68260fbe0b67e4e5765513a5517aa8109b33f73cb31f40efedbc39fe002ed2cf2c3d35906fa5d0a559240dcbc9417e32bc03d8d02085c6e4b874904b996da51954f9756f091256a0ed3b3395af1f003640b40000000cf96aeb118b81eb05db6e0c909b4a7e304571299f0a0fb40884e89c8c6152d3d07332d3a3fb247c489527919beb3b6c5dcdcef0d6381509eface4fe7772f194c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4002111-B20C-11EE-9317-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000d0a54940af81b0cfd75bc59934b9ff96189a66ebcb8a7963fffa7d51a7933a43000000000e8000000002000020000000c4efe2720ba2770682b7e7dc9e756920f0bf8dd159b1a3cee58601c574af58ad2000000003b9ca903155d0307bc94f6d99d77ada3ddeff62fc36c97e7328982effe4a7d540000000be32be9f4fc94e1cb2646c32545e6e4b9512667759a847271c0cdd12685e2a1cc52af19a3fc27fa4bc693664cd23aa3276ecd611b41b2656f9291bab66d83b89	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411309743"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305bbdc11946da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2640	iexplore.exe
2640	iexplore.exe
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 1680	2640	iexplore.exe	28
PID 2640 wrote to memory of 1680	2640	iexplore.exe	28
PID 2640 wrote to memory of 1680	2640	iexplore.exe	28
PID 2640 wrote to memory of 1680	2640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\58e2bc07cee75439310b3d6fcacaa74d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8963af8aa7fe409a0a96a4bd547fd29

SHA1
c49d22a9a0d4c15570f6de4630c6a8c7e8c2ce5c

SHA256
aa4eaf69e8deaa1d70cab87dbc77b31b6b34440d72460a986438cbc051c31707

SHA512
bd7e97cd67df717aee91692fb9c66a092690dc32ac584087a3dd5988ed5c509206edcc1985e9d29a521e5f70f9ccaab9b4e55e83c6c4e319c46bbab7112af933

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea850aff5792ae41eaedab0066572462

SHA1
b5440a641ca2590b683b9c0b633ff5ec7495bf34

SHA256
1732e9bb884a436f51666db590b577eeaad06c7ad49177e7d86203a6fc51031b

SHA512
2ff7512a298705bebeb33ef96087638904748bfad2ae297173cf2632e3d840537b2856128770c4508752f44f9330f16c8240241a3f2b3f659baf82b0bf5b1f41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f09188bc6ecbefdeab4ecf1d6690c8d

SHA1
89e36f7fcbaedb1f3fafa5cd1905d9791e9fdc4e

SHA256
648f110ca93c1bdd8cfec1a983477dcfc28421d8a261b1114035b5f246444398

SHA512
c6cc11a8751ddf370a0c8e3cceb4207efe31882ca44f479fd5809051a7fa57f4d59f4d42a538a211cb9124d95e01b7456194a095e8f820c51e00f790e5d57522

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
774afa5fc0af2c6a02efd233e7537520

SHA1
f13f395db405e3132b5e0c787acea58cef6a02ab

SHA256
80077b57f59533a6bf9aca2b94f9111a0fabf1f0de61d2f2ee3e61c424ac38fe

SHA512
561a0214d78d217c15d173f82dc642470c90b731a48882b5f6a9d7176eca035469d210166996ab2189e53c48959c48837791cc4f4aa1aa3a84973406d7541e3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e54f3fc88ba9d6046638080e690871da

SHA1
b6eb45977f8f46594b5080eb53d68c4dd6bdc9d6

SHA256
9e657a445226d863fd6f51b4dc3ce4b100db54728d498e07a4ccea7e6bf73f44

SHA512
a32696e8545778e70e005f362177e4a8e4459e9de68c63a51b8d6de8c27c47d6b410766221d7d237c9d46c55af0b3d1de43a4cc4979a73137987dfc86abb4b42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5bc4a1ddbcf8c1b67d8a4a2531e8976

SHA1
02bfb9b4425fdc9783e1114eefe96835d9323019

SHA256
005031269b7348208248a4235a8fb80ecc8bc6334423939cb59a11cc7fc68630

SHA512
57aeacfd7fd510a927f61af0b3bb88af5544b3488b5e6325307e7d8e60db68c01d3c12d1b106b138a139031674df79f24a0a83d9e9aec707974211702be7427d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51b454cfd0f9fc1b8e4584befc835414

SHA1
198561924e78d21055744f7c7106fa8ebde54f3f

SHA256
3e4ebf23d515e5ee3399a5b0ef44b30d743a7330d7ce3b60fd45ebc0fda328d7

SHA512
7d8f5483defabef6899b8c589b0cc58d6e0595bae676684bc70b437dfa44f8d05497139d93836a82ddfaaec3fddddcb1501da357fc6c2cfdc84865f3e4db0a89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d391de3e8e08c86ca732f71319188e3f

SHA1
9ebef6d8f5571d8f9b0f5f100201a63745a8905c

SHA256
cc0cf07ee0f5dd12d48f4be80974a27df542a6ba43759a201f8ef26d4cd5bb90

SHA512
714b3441de4c380bdeb11c9f70bea70987f8cf0fe4700e162c302e3b784c8d4b164cf944872cab7037fc5f99752a69585bec4e6f16cbb04f051d54ef3495e512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1510cbdf47e0e50254519c90d2125bd3

SHA1
de8e111003bcb861b6f943173f00f6062505ef5c

SHA256
025716804a8042abab5d13bbb015e26bd92717bf8b63ce6b8cc6daf2e8d78dbc

SHA512
64aeda67e3f7e48adc43679fad8110ae07b0e6d088e7bf4cc4382ad2932c72afd868ca3ce15f422a1304c238edb5811a7c4ebcae26029d0bf601b7f31c453b75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ab3029b21957766bf321d3585744114

SHA1
f2aeec1603977ab72fe6e1e77ae92cba5e87c735

SHA256
06f1bc9698ed9a5a772697a018bb064b70d86ae1a5595311601bc24cc5f4d5fb

SHA512
138e51d7afc4d53299280fcd5f59b2a38b032699d16018e6a28b0ad64c1e8125db84b9f1071c395d44a60f651db10f1201028bbb229aea8f39477eb6536eb43a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6f6b7a1a938623c3e01aca9393785e0

SHA1
3a6070e06dc1aa7a611721d3128818415d931725

SHA256
131d6f97c1be9d73e905aa4314152faf2421d873322f6f1510313d54de623d90

SHA512
fa721b8c8a1cb6b3410e1ada62d88307b5cec32788127f02eeb56f7d377d9c2fb2f3fb0efa5bd7e7523515f735ef596f3635c1e60ae5f64132ad04d456e68975

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e67f1b51e1201a789ccbac390105ca3

SHA1
87a459f41487a843e29b17c5c82c6da6087a88b2

SHA256
53cf127e6d6808fe0398ebcf08cfbde3362f8d8e37fd5027b40d8a7d57e242d6

SHA512
d45d5cf907b0eb36789664d7066772991e673be7ec80717bb087548961abc32cdb66c861ccf0c17164f801c9e3e41dd3d7135cdeac3c851a7efa8572c8ebebc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12459d79cc3b4023231e79d447dd5992

SHA1
99f37c4ceed3458e44eb7653af1847bd0b40be1c

SHA256
dbe5354ebb7174e64b5ac9e32e14e83720d306a3d08b82f14122cbe24c558e3e

SHA512
fc5635c1d1b8b6e281477e11c5b6c3454dfd359fd594b8b088db430174eaaf2185392f6272bf0e391bc9e802f4d530cd2601606c0617cb2f5e6d6ac0e85c33dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2744c503300a79718543f70f01a99ba

SHA1
130366e940d9b2fcbc8dcfbcca90de5ac8eded8e

SHA256
db6dfd615f42afaf691415610bc93b6992ea2eb651ea525e9e8d188efb0a8a59

SHA512
82c4ae2787ec6c2e36a8dfa23ba9df2193217d301faaf1a0d98da04373c9a6144a581f243851ca0bde96ebcf2bc8bb9b7f7fdb1ad847eb7a7b42aae58a7f9603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b699a728c313df71f11179759b46153

SHA1
e14f8fb22a60a1d3d0ed5667faae89bd0c977a26

SHA256
04a47602606d9b75375481b83763723ba68b9096b2592d76cd41f66845512374

SHA512
cf579144fe8b5049231811127b7e565aacc0873f87b52736051f112e39fb15af3ad4303f7b522b73b9c5d1699621ac91c4d1779012d076f1671d1c86bf5b7af5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6ca14962793ca763def695c71103434

SHA1
bbd27434b3449436c607439dfdb299d0b35eecb9

SHA256
da7c5e6c3e070031b806b6c43429d62e529b69180ee794bd055576cd29002eb4

SHA512
c131a271bfa544fc0b8a0ab8e503a34176d9634ddb8436a640f51b4a48e5946a3b1b5fb65797d53b9fd5a82a4341292f2126d3a6917c7bb575b19ed153e15a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab625D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar628F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit