f27b3f0f0ec6c4e0c00d398a5aaed477b66d7e946951947c4f520c142329fe33

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13-01-2024 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

10KB
MD5

ab4570ac5d3e43b907b860e57bd75ef8
SHA1

fc03e152886326337266ca9caaae884a833b39e6
SHA256

f27b3f0f0ec6c4e0c00d398a5aaed477b66d7e946951947c4f520c142329fe33
SHA512

baf42520f5f90f49578e2790bb19b3206ec51dfd24197d2d3a2c3e76b0bd41d1d939f7c592267e1cd032e6d0b42834ed43d94c273238818d1bf661aa18fe4ef9
SSDEEP

192:KYamJL83iA6oM/9HZ7RJ0e9hFQU0iESI+/vHxsWtZWgtJX9RC+M:b8SAe0CwgvHxsWXWgtJtk+M

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000064c280902f125247df046de311caea0c182eb0a3b0f3d3931997ee4a0c012b1000000000e8000000002000020000000d9f44e3652dd7e16878af79e9a9e51b23807362f61ddb194f4be0256c40ce32390000000c140de117496f978c3b1638660ab5d3b372780ee1c7510f92c2c04696be926c3a5ad9b03a15e94b7f3c2bf95e08e19dd6181d2da9fea55ddd2cbbe10eb79e53fdc19bf5955b322946ecf3fdf191645955ab862a3a260df3d1d72b3774b884e176bdd335431c8c8dfaad7fee9a11b062a9aebb8177551f4363fcc6d9caf5491ba0927d741e4bb4770e7a1af309e84b48a400000000928eeab600894636e382760292a3cddec777171b7a39a70acdfa3ca36203e88ff27bccb19950b7780876963a014be41799d4529fceccebdca69ca77529dc54f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000de380a0751c8777f34c3841d40fdc323c307fa8df86a0d2f9f9b6989a0fdc014000000000e80000000020000200000007d0abf92cb3d66a81937945e29959a32cc8cf618d586b726fc77c648530279be2000000061ef2bc4fe45c913bce33a54e601413d28f726e41170be140102104204211e6240000000c5c9a8e880531f370ae1be6c225c2e416e796ae005067f9947ba45cdeb72d06823e209f134f9a03cbcf617efc281e9a3252b17bf95a32d8f0cc4dc293fdb365c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07c63a43746da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD0F2361-B22A-11EE-A2F4-62ABD1C114F0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1768	2220	iexplore.exe	28
PID 2220 wrote to memory of 1768	2220	iexplore.exe	28
PID 2220 wrote to memory of 1768	2220	iexplore.exe	28
PID 2220 wrote to memory of 1768	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0483cd549fe6426dfdabfc5055e648e2

SHA1
d5a2f3eb53fb47b4f6f68c8cc372e44dc2656429

SHA256
47d0a2012f0979b945a3e43a0ee5bc7ef1562434f79c94a0e8cfa41b8259ffd6

SHA512
1e673df053e18fc8cff7fb3f79dc4756d544b24bcb7fa7816bea2f94205b5b29039f2ca3b09229bb68d8febee937f359b3e8055d7e10dd3acb18912913e647e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4430205bcc06c3685ca186679904c30c

SHA1
70eacd25d509f19612719a77d181a1d9ad046122

SHA256
121557060381ef1ec7933471318924466fbf936bd7b192fe0397d5548291d908

SHA512
ac042726fd32fb59b900a128adebebedf5204a277e4a333244dceb3d2eafa7a7fc359e5a53381a0b82f5c6c5d00580a2028eedef47d26dcf16d9c71916759252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcd8cb53e673e0721776f12ca62e865c

SHA1
08897fb14b36963bb440ef2c8071760c087f2e4c

SHA256
b4574c5da916f52422d32de8ae88ff1f65e4636f8218d667a338021c4eae3653

SHA512
bd7bba1d36dfc26a94b916fe3204c5c35230b1add1642bec2ed2b5c4f356e4c7b6b2fe876a6e9e9de709b18942f1ce4f71c974f965d1cb10a881dc2ac1c653d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7412bfa1135a36277c098307e961606

SHA1
51a5afed7b648b9d4b1ccde9a3316afac03f5fce

SHA256
3571bf383d2e5cdf3f5f2ffa7d31110924eb51ece266099d06c88a2237786be0

SHA512
7dec54ee70495b4208df01c5d3f4ad40b6c796f45c8c7f3d88e74f865e401dd5b2831729a547f88812cb05acbd1d6c71840cf519034a32bdbaa5e0a3fcbf023c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19b2a46de347c0b77028c8c496aa1192

SHA1
4f69cc29373711eefe33447e9c8a3c342b54e4f6

SHA256
4a019e96798aefb4cd409f5d0ae7708e6f25088bc6c696e195909d0d355be502

SHA512
d882a00d19fa08f01a53da58a30da7af8ec865a9840d605c104de97093fa0c70fe51f5d29eaf0b4fffa0e3925cab28675f6bb9901616a0413d39fd5b59adc29e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2c41fa0c73ccf4a195ccbf2a7ac06d9

SHA1
47c18fc5758c5b4039ce8285c9e0158787374675

SHA256
16d55b4c32fd844fdab965d398bada8c560e767c3e94bf6dd0e03a1e9b00bd9e

SHA512
5f528c2ab846a2abf207281ac1e92f889aa2a7d413fa6577f3373cb2f29ebc56d2dabcc7f710bc6d21f292ae90419bac25ea8668b1c00074b3ae632cd21b87db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05994c0d51dace6b298255ef0ffdf858

SHA1
e8ff8a8bc3b3ad6b23d1008e749150785757bcff

SHA256
cc7d7c81af7b4ba645c89a7c9d689da85ab2a0b73061e19d03751c7d9ef3bcec

SHA512
10d3d6289e492232a2595826df022290a6c2ddb89a8e57b9c3de4fca68e936a2caeab0f6dc83014877a9ae48ee6109885e88b987e9169a0771c270e2a26678ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
291eb91885ce6d5664af0b049add9f51

SHA1
b71858b3c85cdd519c6a3a484d5bb96f9c040b56

SHA256
4b6bd3cb9c7b57e8df501ec1163f4e8da495279bb0c405604449e56e84227588

SHA512
424579b6fb2bd4d19b89b486c9227310daed18e944a0f91b21abf665fbd7eb286d076342cf8962472d474a6d5b50ef67168a3b2faae9999bc4e9f488089adc8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6fd5f4c6655f48aa6d10785f181419b

SHA1
fc36f2ba6e9e9fe1c27bdfc57caf0cb8ed429e3a

SHA256
96e6880f1d98b25dfd045382e5e6a94985eeb98fdfb2b744b18c06dc42e5ed6d

SHA512
369f9ee66a26d324fe0f2d601122936c0a7a36f21099d3cba6c2b42c808cd582d854a9a313d61fbbab600e2b8648a72a6f7514dfa4a086854009ba9e3013237b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfaf7a9c4763ba9cb8e2e94f8f5a7a55

SHA1
faa0a30dc68ac1837d4a8b0ebbef9c1c1c055d37

SHA256
61fcfa4c2c1521add96892f76f8c5f42c77d49d4816a10ad9799ec8a51406144

SHA512
abc9462651ebee7a5c2be90ad9151f3773dce633c4c959474ace898b00811b80ec4a32489013b0698c845963942f92ac2c5816c8de7ddb7a5c93bf857b153c71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7a547e0b968ced17ed5ccc444a0339b5

SHA1
1efdda0f5ab778548a302fd6ffb361d89866ee75

SHA256
d5563b72e16b5fb676265d0980b5a495ae3712d9157e54b4ddc4b24a7dc24f87

SHA512
873a673be11702d3d9cb7588e21075fd8faa97c7fbce553b4a16962a29cceaab981324bc96c234174ed06f0e1dd3f36b069df15b6e2f58d4cbc83a7187eaf3ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29A5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFCFEB171C0C49C10A.TMP

Filesize
16KB

MD5
213f08c6bbc81480865403e26f2b22f6

SHA1
14658c541d456d3582e00b8f9d2889f52e386726

SHA256
2e0b43e7a05c77cb1c5d41281a3395fe310ee9d6f9e9efaae41a4299fcf739d7

SHA512
63f1ba40768b6e023321b8e006cbfb6c82849ccc89d818a95e71514389449f38530ed4ceaa9a2bbae40f85358c5da4eeb4d2e851308f97637245262e0c55c5d9

Download Submit