e3c05ee3ebedadc8e889b0b3d817beaa615ca93214607529f282609bb8c9e297

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59e5b8832a35f1a721468f780d84fa46.html
Size

9KB
MD5

59e5b8832a35f1a721468f780d84fa46
SHA1

5da41c3d5b164c3c1c3ccdfd5e88bad68d9a8f66
SHA256

e3c05ee3ebedadc8e889b0b3d817beaa615ca93214607529f282609bb8c9e297
SHA512

7a33d24301ff0b1cacf6f8bd327ed2725aadd5eb8a5d666b74eaa29ad6df3d3cc253b7e3e63335b78a79ec1b63a96004407d230994d6663b889f43e7b62d8a36
SSDEEP

96:uzVs+ux7SfLLY1k9o84d12ef7CSTUaGT/kjgpdJxq6WF/xyVp9elVHcEZ7ru7f:csz7SfAYS/H6dJqeVp0PHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA46EEA1-B27A-11EE-9569-6A53A263E8F2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50829caf8746da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000003bf6d2b274df4054619f038613f6546463fb414491a33a177f31d7a0f647f942000000000e8000000002000020000000dbd14c44c0f67252fe0ff57c862a9eeaf2cbf2f6165fb5ad4c301ce4fb3757e020000000f06cd77278d01dd764095cfc42b04b38148afc27f60ea303250f51f8033820204000000016f7e1130eb908214a132e14bd69c58c898cde41ad44253b1fbca440be0fe424823dcac64e23870f9cb806fed00a511922c2acd672927253bfcc42d0c8b6043a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000004ff7a73738126e8599322ede9ad978847b5686ec541b8ee154d59a6a4dbd1110000000000e800000000200002000000071a0039546025028e2640b756481150335c06044da2f13bda94bd9210d7d3615900000002244c8fe5cfab4b43b44399f9afbc9bb74f1df4bb0c9b9f8ea714cec60df0e94f16f94c38a0340a4f34eba98b00a00cf34c11f7e4af1f928f5c128d7c12cfb2ecca0cdd08e5d84742b2792e2afc44f565770f50f82a50dc379c1aeeedb02cd38691785439e06972ff4e9cfc8ac6b7101235baab0345989d6b12bda5abd6da7ecb8eae33ad8abde3e9c2240532dc2aeef400000004938e493574c2cc0e6df42bb188c1cd84bdfcb2b217e7761fd2bc7df65cd68dfd8c913e40753828b5c6d15b2bfa432d68315441e21441af24bdb136e5ae2137f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411356990"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
832	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
832	iexplore.exe
832	iexplore.exe
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2924	832	iexplore.exe	28
PID 832 wrote to memory of 2924	832	iexplore.exe	28
PID 832 wrote to memory of 2924	832	iexplore.exe	28
PID 832 wrote to memory of 2924	832	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\59e5b8832a35f1a721468f780d84fa46.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af027b90758fc3d2dd6a9177d0cc7e97

SHA1
47828c983ebeab0ab3a9d39bbf40e5dc6f8f3f80

SHA256
8f13630d8f93eda78a6d420bc542b5bd350485a25481207ac37cc49a644e8c91

SHA512
b32e3237c235e5253303ea5a1b787f1b0c6dc4a43a488f8de11d1dfd1fac36913787643caa2ea54ced9c79561d1e3ae023fff0edf620ac2080ec684257f64d08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c32ff5e45cb4c848e73994900e7c583

SHA1
f8ad737d701fca4acfe5360d7547e4aa953f856e

SHA256
8eb5e28b568e75ebd334025c7fdfdbb81203c56f16e9a782882bd727ed154540

SHA512
63ff6d6cd4e1be4e64d0df06727d3f65b889c52922e27dfe26863f51d24735a945f856d197fc53abbfee02fd6d0edb3f009ca70964aa2ad684de4a54b7792bbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cd52bcb6c5cc856328c380516d06a30

SHA1
0edb991503b70977e6abace02a45ceea2f32db11

SHA256
737b1e0f0bcc9c0af132835ca3f0e5bee17b8e596a113bbb037cc07823fca62d

SHA512
2dffa6fe27d89358499ffd0d0e81d2068b4491e8aa2d7167f6303ebd15a139f4654ff715922669bc60c9705c18a292b1f6be03ecc7f8aa872b5993ea5f43c978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e67252ff0fd7b9f0ee1a39dd76857ad1

SHA1
3938bc849e808b0dbe948dc3e06f57121f6bdb08

SHA256
2f99f3816a066834659c654c73f4a804178c3dbced5dbd24eb3ddc11ab986d67

SHA512
9e9bb6ca373b45f8f688ae95a3f2719d9361f0a6edfc857833876816d258651a8a7d78aa031a472c9e00be48131493ee1437931427617b92f90008df8f265e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dc55817246fd174fc745b632563dcdd

SHA1
1cc32f66adf4334016d5593fdd66ee1c74aae578

SHA256
0fd1aa06bab297b9f57f8aee4b08f5782fb50887fc25388b86f465adf3583569

SHA512
e922e9965f273dd7128985aa2fa222f9d63b591bc762505ffb02c400a522dd621b8f6e36f53868084d1acffdbae60c1ac491406784f69b664c6331382f442fd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8a566dec3c7dc4cf2744c6601a40405

SHA1
bc736bac689fefb201a3197081a9acbb4a1c1793

SHA256
3aaf8dae4beb152445182f8f30105122fbc85421689361d982d64df0dad8285e

SHA512
fb6ea91d60d93b63ce9c19921de774fd47b136225fdbd3ee41391edb7c176b4776d8f939ae956d1c0c418e5f8122ad3353ab50c3d347b3457f576d372a3b0f2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a844dac7354072c744a6893a1c4ddc2

SHA1
5c27a824b15ee66f57047bbdc6ef8f001d4f1fe9

SHA256
42653e4e292240f12f070f1ee03abfd3ed13a45c486f45b10258bb3ee9843863

SHA512
4513cb662f87480f8ea49128689e8575972cde32d8ae3a3ebc685deed5a11892736307c18d5420830e9fc80a9373b98a0b7dc794aaaf164698aabcafd402e8a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3807e23bccd61dd828bf5ef402a4f58d

SHA1
0b8fdd18391ba98261031754246aa53b7b0b887e

SHA256
6ca51c743c39abce01457e663f8c7b3f96c61555071a4b8e83456d4474f2e5d9

SHA512
7f22f2fae91c66c025a897bc4f24c279fad508769e73e545c5611de915dff0684482190291d5ed24f438080fb8891fb3e34852c49e66da4b0696e9e39cd2d72e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bfb44fc19bc69d243309ca6b74d10bc

SHA1
cfe6e9ce45991ff0d404c7634082d9009435c296

SHA256
eadef242a707d3bb07c5cd7dbb5cab24410c994883f8e16a8ee8feae7ee93470

SHA512
e01a4c9234785f0f1465f868da66e8a6665828c8ef7cc1b256ad851b007afcea52673dbb8ecdb195825525e37760ad52265ea5b366a7e11ecfc81d03f67f31eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22383c3628c43c30bf8249aba57238d3

SHA1
9021f8adb49f30526d00c883dc14bec2c11c2c7f

SHA256
d4a3ede751e5438a3b81f1b5f8cb0321f96199b88226f6111f51cc9aac7ced0a

SHA512
3a92e1b60b94dd1ee4c0904765d22da71dc23660cd1a825664bab2805c50e675888ec98a01a8be02c6f681712ae6d77b056517a6a91fd1be1bc4b7a4e7ccbed8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e40ee591e352d031f87025daafe6bb79

SHA1
787ce013807768b92eea86eeb1857d055ddc0be1

SHA256
18995ec0006d282a2835d956130ab17eee35948b3367cc65769bb18fa96e5660

SHA512
e7524450ba9c3257238fc5cf466be91635526f68eca0e2d487607600244c4e967b179fa740d3ace8bf9d0d87fa774917c489e37531f46990747c01a8d1403a9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5C15.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5CE5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit