812feeae6316566ea4ff015978674d8ca2f764abc75bc5b081e3527722cf8095

Analysis

max time kernel
136s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5a4139cc8a1d57ede5dcd1f862e66a9e.html
Size

11KB
MD5

5a4139cc8a1d57ede5dcd1f862e66a9e
SHA1

18770ab84de892fbae83987a0760242686e66a88
SHA256

812feeae6316566ea4ff015978674d8ca2f764abc75bc5b081e3527722cf8095
SHA512

bec3976c7b90be1fc1261d078dd3d51c0ea02626d53beb6fef179328f6aa089f093170e26e6eb443fd14e6db9cbdc65bdbba93596195e853ff2a90430c95e5cb
SSDEEP

192:SdUnCwbm91KBel2YQNV08gyYH7TTDIRXT8GfXBM:SwC2+u8TkLS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b24879a046da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000001f71e8817bbd856f06b46a7a759f12a33266552840a496a7954dbeed9cc185a000000000e800000000200002000000091320944e90ba6dea2afe967ae5df8d8ea142c9aceade4699c55eec9e8c7f54790000000e4eccab5822479734ce750cc0b4687edc3ac129590ac634ef37a6ebfb498ccd5dd43a5bfc66e3288493a992420fc91485f47726c0a3bff2871d114a66834e4e9963a42bb5a0bb277f48a827868185f0e61a6b391842c291bf411dbb60bcbf1cdf563c07be8dad83a2e185e24b5d6e149a3eff44eaff0ee056a6055470ae29dd003364c84964f973979e5c493a8a1a22d40000000263668ee905648d4b67efd1b3ef74bfae6379b17ceb36e406526320300a07fea75225fccb58c88830ac1303f899e3c297b88ce02dccd06b5cdd77ea5ae1f1428	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A15CF301-B293-11EE-B58D-6A1079A24C90} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411367633"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000007a231cacabaa889fcfcb88c7f98b8f0987f44e0c4b3acf1b2116a1bcd07e8674000000000e8000000002000020000000ae5298621fa14523b715d0311cdeb2fd1b710d4999a2839072f02fa9b605997b20000000bab5abc8dee249011254fc9eb678cd7cc599bb84ee5f26034c7e8e01459e5e7540000000ef8a754297cef9668beaa558af24fd045aed114cd716e72b2fa1c6c77ae16e2d8c303066b8a3f80ec5d176578d857c2dbee2ce02e5a428d9816fe672f165b509	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2416	2184	iexplore.exe	28
PID 2184 wrote to memory of 2416	2184	iexplore.exe	28
PID 2184 wrote to memory of 2416	2184	iexplore.exe	28
PID 2184 wrote to memory of 2416	2184	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5a4139cc8a1d57ede5dcd1f862e66a9e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f77aba0f3f92bd0f4add976d0342868d

SHA1
07d377e01d8acefe1e66153a7221e0aba5773ec3

SHA256
dadfe3b4682d4aec0639b6f8cc08f9d9a672ec315427a9b94643d55a7a64623c

SHA512
98a48e993d97998df71d78d7273d32a40338ee6e1a3bd6ec12ffe3887c10188b4ed0a3fd280e911c7b865b2e52e03c537acb34741b54f082532553999d69704e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ba06103ad000b9feed49d78ea639826

SHA1
85b77d015e1b15de1d64db048abfdbb549748f5e

SHA256
effe68c7e45db10d266fb6a81c5978e518613d14990dbdf3d8964d42855bbf9e

SHA512
7740f8d200a425a5dcf75afe3eda9d01817adf5365241df87d10b1152b6c9294404911c5907bcd746a5fb442ee5417d10f35cf549a8017028bb6080eafcc4f53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39decea1dbfe234aa95ead278ea3948a

SHA1
b91a372e1bd44090612fb8182b1f0dd113226c09

SHA256
06f41034f75c8b317a7fb0bdc6d67a257c8829ec473227790e8aa782dfb63ae3

SHA512
58efd690924aee837d8f062583393e85aa2e15d2d7a935329540d3c8ca8e3e92bb2b2be5c98e708d3201714db6298f2b3f1f1c819a7ef61f6af05c269f5c414b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b36824f8c5a6f4477cf94f05af2d15c3

SHA1
e5c6c51118ca47e1288e21c4986134676dfc83a2

SHA256
1a3dcbfe05a5289a9d8383ed2d8472d70ecee96baa8fa370caa875000141cf09

SHA512
1cf343749d12dbbe507a2093c608f4bd678675e1ad062b50b70d10a52a6819dc49aa0f8bb11aeb6d3f18fbb2bc9debbe0136b0df01647c578717998d8da8e90a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2861bf9796dcb1f9ff765d6fc1c86cde

SHA1
7e44ee62796c48d5857a985dc4f3290a95f6f88e

SHA256
ddb78f5c69e97321473345f73dfed637a6445b9c1c80e2fcd389b02b05e60524

SHA512
8fcd7892cd14e46780ce56d433b47b8e91f49bdbcdeae8c6c8f4fb33e90dea12b9c23780250603fc78047dcfa740abc9d8bcaa6e55f7ce5e3a3de0496673f516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
218327c24afee13ee1cfd40bdfaf6875

SHA1
f8966eaf7ec07933e45a78189c2553df7a424c18

SHA256
59c42870607066bf4f23f210e1307ba083d46f7ca8c4def4ef75a2a90194bcb9

SHA512
2df3f5dbb6f9cb636ae1230520b18960a7f2eed239cd7ac7abf086fa16aa274705d3723abfb220e53d04a1d7be9452d371b5c8bacc4762c5789155b995a32093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14874199097b80851b12d8c4c2e71c5d

SHA1
62d21fa50e9d2357313ccdaf791ac34b43b9f933

SHA256
1d732cd05c10be89f99b3e205f70d9faca6940eabb6f8d535297b7e1e2b731e9

SHA512
4db712d19e00bd8fded28919de36e7a366360e17facc88a94930c992044d1051855cdb79fc1710e54169364228feba365dacfe9ec6fd3b868067015b97f0a8df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7de84391d517904d351dffab1f483a8b

SHA1
d1c0dc4c2ef0cfd364762bc7361c14959157eae0

SHA256
728f6bd985d0f18f0348f73069c6ebac6689fde3a71bd1b832deb79e813ecb0c

SHA512
d728df124809a584e1929352ec5a7f1b37166259befedbed7b27eff64bad40e5190967281d96f223ff460827f02dd53b69036df5225a0a5ed21a35a8677fb854

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74a181327b7290d14ce03a7b4506c88e

SHA1
aaf0c073e1bf95f6d455302960d79bdb0d1742d5

SHA256
f7bc893d561607f6c1264e068cb5ded66d0937015f455217097222120fc62a92

SHA512
de6eedb7120fc9f223a50f2eede85f83ff801ae40c18a1abde9f294a63356b923338a8a8a86206607259b339e84db80c1bc3124437625e570a97b487ad266ab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc82e3ea6d3d1086496e62a8bc1ea32e

SHA1
45c75dfe855fd9698535ebcefa31cf1e6a466580

SHA256
d3e282ae713a89564dc7f4a801e26f543c65253ebe2ef9c5fba8540c5d14e7b4

SHA512
0e00b81cc8f36eff8a20658076aced6513272b0283aba6b7ba5964aa922d4e56e17be03cf17f4ffc9e118eb9c48efef21bfbe5791faf41838b9f24bed21e53c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a343b3f41e9e99c79bb6c1ea913bb8af

SHA1
1acefdc4a1eab180f023de08637338fc1945abb7

SHA256
856352e6bae9aa64e076d2e06de584ae98173e421c1ceab665fbfaf2dd8095fb

SHA512
c50b85900f51c954b03eed6c0f81fcc056e6711d783102740bf28462c084641b4a11fe9399787833f8e1c7a8bd5fa4b5d5e31d53389f70509bab6d585d80e93f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7efbefdf7a016581589a9f7edbbb5753

SHA1
a1ebb78a3159c424310dd9603f31743db8e18651

SHA256
6b9cc10b5b4a83c01fdec93801cd15d63998ae99bf4b7200f5189fc26517092a

SHA512
6c0e13db85d47c63627d45db4e09e7186a571ef42701dd66932c9f2da4690cf3b9878a800c58e96d5f9d82b09a61120a3d51dd0230545b2aa6bbab1108cd1710

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e929351dfdc2b03b67c4139b4a6d584

SHA1
5f104f07d439aab1d678b67ffcd3951b4182e2f8

SHA256
c0d82c6d438891548fd6950d4973e7d3ae193c016be417d2e4f32a8e5b43d6e6

SHA512
2e5473f2690a9b71d7b9b22019da23bce86e58e299d88047f21e1281fd9812473d52c1ed9f79f06e0a1d0ee4506e3a4390a4dde92fcc1bfe7f199de5e6f0ee52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
652d98900befe802fbcc0343300414d6

SHA1
f6809c5193ac40edae0c933a9306bd56ebb24777

SHA256
23de585311762c01e39b44f30d2266cc82d0042d2a52c8cc4e9e8be026b6772f

SHA512
bb3cd9e05a8bffd8d787f0127bab97430090b64d36d9b24af7d3a4d0efc06478ff7f507bf4ac0f37161798fb164b2ac059cd8f1ca812d5e15e4d0b9ec075dae2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5e13ec80fc45c0a581564ef9af2c48f

SHA1
638ce74399be69247dcc07994b8783b2c749c29f

SHA256
e4a3fc9bd2d6dcfb5fd3f55ab7e5f8a0fd13d93dc5820292281252a7ea44a81f

SHA512
4fbada22cc05e111d72b9a19e03f46e5860f168a895afef82c187da2292d4a4b8315d0f6779a9a470110d2fea7082c08820caf7f884d8b49cbff88fa3d690c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75a7944504390934adc012baa7415fb3

SHA1
748293674f305dd065539060a93e3a71e973e779

SHA256
667f234e05f97560da590f5c7ee481435be5a9abd739c41db40ad0eee515c0f9

SHA512
3036a3325388fdd198eb5373e751adc67c2f72186261ce4f24480c6d5e86e83051e317b576db8d4164799fb1e9d04d98671e6793d91ca232a8b94a9c6ba49418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55ac5ce6f21c57202f56c2d30ac2f23d

SHA1
d806c24ee483331edfe66c661d074227f3b7b808

SHA256
fc4565fb1d3c8ad8937fb3a6574e31f500913e13a346ef44cd501dca7b166436

SHA512
6b612565274973e8ac88eca768bf4f4313f712ec275f4898b5a081d329e3bafa9d1f5ae4fdceea445ecfeb1f711c7f4222224b72047faac71156547fe0899087

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6D95.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8221.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit