e47b6bae41febded5ecfd9ffc9903ca0022b574f05c82dbbf68064abd7037562

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a5600a78c80e580a719b9533313bc42.html
Size

53KB
MD5

5a5600a78c80e580a719b9533313bc42
SHA1

30ae20a2560d66390eb6c3b13de8350631d39142
SHA256

e47b6bae41febded5ecfd9ffc9903ca0022b574f05c82dbbf68064abd7037562
SHA512

2a255f112dc5c8a3db0c890c05af3eb40a18fb3b6087a4eaaab95aa02a7e5daecb80725cffbd007cefcab0ea922e4d53993e74977d8b04eee728d5292009dffb
SSDEEP

1536:CkgUiIakTqGivi+PyUArunlYQ63Nj+q5Vy0R0w2AzTICbblo1/t9M/dNwIUTDmDN:CkgUiIakTqGivi+PyUArunlYQ63Nj+qb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411369883"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303246b7a546da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000219584c92cb3c5277805db03a78ba7815951813f32c8299eaa201fad9e693aff000000000e8000000002000020000000b16b0d1526c12aaa103843c5d532e59b9cedddd400c307334e89b61b23e21c72200000006bc77f545fbe6b101cdd33d1824fd52e7af73b3d28ef07bb530618c38ccd973a400000002a1b15a96d400da4aa91c3b34d39f166d0ff04c53aea0db83a6d5a32bc6e72da90e79fd1af68ef2eab05b9c4d4fa8536d2470001080c8461dffd86701c8e077f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000015915f4af61345974bac5da76e3362333677396b368fc73731de64506726a912000000000e8000000002000020000000a07b8eb3cd8fde13b0c99d1918444089008a8399eb33769d299cb311132ff545900000002996b60d2f7925985bccd3e855d0146a761473f65b7dd9f7f6c1c5514136f6e1cf3ea54ded89711f1997b5f06749fb477b15bd95088762fc226b8ac5f31a9bff23c7d80c870583e16af6da43b79f92d929f956f288943aec984a12de8202fe6748aa67608d089885c3ac42848afb62c3ca45fb39c92951ed41200e9f8d309752a21b93f678a556398a7465fc10f27ee34000000070fbd7a9f17aa97f0670b237f533657f58f980b89c3efc0b1568899696ee7f13128fbde8bbcbb03bbac1102278b31424d91080cc0497abf71621c6a67c87b7f1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF1DDF11-B298-11EE-BB35-72D103486AAB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1868	iexplore.exe
1868	iexplore.exe
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2952	1868	iexplore.exe	28
PID 1868 wrote to memory of 2952	1868	iexplore.exe	28
PID 1868 wrote to memory of 2952	1868	iexplore.exe	28
PID 1868 wrote to memory of 2952	1868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5a5600a78c80e580a719b9533313bc42.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
1120e8ca093d305b2fe5fdf5f11f8470

SHA1
9928f8de25738cfe1f556c613fc40356cb37fac4

SHA256
03d39e9c1838b73865f511f3bab672b31e134cab2cea4e9c1517728061dd11d4

SHA512
ccee03f4d9240a05bb83bd5fafe585738ed8e7600b6740659fa5ad5d9defeda65695c4b23fabdec281d03a122e7a6dae077745fb1271c934e8d89537a5392f0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8ff5933f66e422436f911bf518dc459

SHA1
7fe9d6465d85922e7f28224c2b04958db1afddb5

SHA256
f7556402ad092400c0dd5ab39b89c96517cca620733f3277aabb6b05c2eae935

SHA512
33c28fade99f051583f1a3d1be02e0fc949fcc800bf2f44993aa473ac6e5d5fbbeb0b7a76d0f93beed439490ec33b701e5f16ec78ddeba7d47c094b6b81e619b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f523a61c88c3ef05a5b5ec8e77129831

SHA1
5c6679265c7dc7becff202a1f3dbaa10c482824a

SHA256
21c6b0707e61b2d7148636ae37e0b24d0a866100e61ddd0fad93c01bc8001011

SHA512
ca7b9f820e8e44500ff7eeee3eabb198b0a164fd688e1c80a906016fa999f5ab28f9a248d18c7dd51e6dc9784af38fb6195ce3010494cac4fc6dabc565f04b26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2762c3946245bc0ca949d1de7cdfcda3

SHA1
f9280f55238596e931661195e0fa232ac473abc0

SHA256
c249cbfc446b0e7864d193e93ca1efa9ec87160beee7e753a1f0785559c27bb6

SHA512
440edb5c615a7fd97ce8f5aaab7ee790b14bf7cd582b1a96f6c96b1b941187094177f9133c159e58c9bd0f5df0443337d31debaf53360e9226faf5585fb22f57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38a51992744df56ffd57766dd7f75b20

SHA1
ac5a9606849b8c816e43e56d8aaea81ec242249e

SHA256
cb49533380b0edad39718f07c94043dab0dafec60e380c5d203d61626b964818

SHA512
8d0c76b6ab14e84e8f34a81aba8182a66ab8124ae3e0847c79330874312fb4dc8bb2a29d3c96615c43a561e527ad6bbe404635a26c7fe0bbabcdd9f3a7e06470

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b82beb9ab8b9ae6541c2a8ec61163a9

SHA1
53b49178fe48f30dac5396c286929f350621da31

SHA256
a258efb9bdd03c03302b5e31e527616340eaee69f0e91e322c376ed03bda9309

SHA512
bcd8c1f1627f9382372cb56f0b6912e4d662c4b6d6ab1ee8b6b3de87ff4d06fd6b8d12d7c40645badc1d098df334b8e107b9e2df3459e7dee79ec7f4e5029157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2d1043367b90463329c5974ecce5d43

SHA1
5031523be130fdf47dfa90c8eb13a5d39e12d538

SHA256
ea2c1ee10145c1c971f273007aebd54de8ddf31881222f72f895298b02432c7e

SHA512
d32e00865d1f0a6b0c28df26636f0f91ff347eea5fd918c5531b5d5c8e4255517971d3c96829ae29b1cf3ae5da893301d4c9c079983de4a4a1eaef6ea6a4223d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f498e90d11566f1d3a7e37f2ad4f8114

SHA1
7b1658be912c6e3a73c0db62be8fdfb004d87713

SHA256
e36a4848577f4842e5c08bb2ccfe078fc7efbfd9dc8f54ae65c9d2571dac4848

SHA512
4823273e347d25d5b80c6a81fc43fd82b577b55e6defa8c8bfbd281bb59b3443ed64b13009b4c644a38100ea52cbfed81f7ccb87664c40c155df2a2f668694c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e87edd1df7aa494fc11f746bcbb1d17

SHA1
93138487b8939b44e8b73b4f18b9184b883597c2

SHA256
469974f40b8a069038eb048ce7861cb14b9a25e036993cd0be65177b9173dd5c

SHA512
4f7c09d143887aa4107b8d342eca4371b5462c2d10870c0d955a431b45df0c2b21be3f7e92106e786502492be33886badd7e39a83f18ae79f56b7f6fa6c66e86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb699d4d0560146807483949339b6e6e

SHA1
4b80249bb12a0041a7753d680c262bf7c47ce460

SHA256
4324fc3c0acc16c5ea6af8b29dd96a2d441569fbaff06313c014d15c80f87df2

SHA512
b31a33ade3d95c97fa66500a16aca431689d8db09cd223d274409862af28f2322118ee71ca1e5928ba88ca3befd8aed4e000315025baa4dbcb36fd58352e8f2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb5b4a2f779e4ef781311cab9e420876

SHA1
dddbd0a9d60beee98cf76a93328021e1cb684f3c

SHA256
4654c970ada4ee610c763c95b80fa83ec61f1237320c78f78a51ec3248bdbdf6

SHA512
d359eff1c95c0b566bc3b55f0fa2b69318367b38076edae62a95d965f6367e23100d8bbdc80e58710443703cf3abda61e1a250cc6b1c55ac4c1613d7fac44f5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
95160fe367b25d2c564712d8d4e4eaf5

SHA1
876c4d59258361c07fb914c7bc34221934401d1d

SHA256
cabab0e4161609447d0d053d720f5510c02760c64fc584d6f16cb7c3f30c116f

SHA512
a7543357dc1f690f70ed431fb81490142834ed78bde353aaaa39202ccaa4d9eabf643ed24da2720eab711ebce8bfb8fc115ca632612955c3b11f3a34360c0842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5KL03Y0R\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3124.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit