6d89ff6f05e461d71480ccee16a0574372e512d0e7d76b21a02d000f8769183f

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-01-2024 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ac98896a71419e6f58418a4cd64b209.html
Size

41KB
MD5

5ac98896a71419e6f58418a4cd64b209
SHA1

b0ea775bf4b773d8f7d4f23653dd0408fae707e4
SHA256

6d89ff6f05e461d71480ccee16a0574372e512d0e7d76b21a02d000f8769183f
SHA512

4edda9a8dfc798259d3e9c3ea13e867f108750ab2e9d6a4682bc46681a2eb66c5053569e582a115b5453c3ed6c780d8cc7160e5a8a3fb69a65ec8e6926408dfe
SSDEEP

384:GQOtYtkf5qF/2/s/pc0HEbRN3hvk8ctQ0acmCYC7oQH1nbMeEvmE:GQOtYWqF/2/s/Mtc7Q0abCvJbKP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d4cc658bb50852b90ac3af7c6ca02d19b82f3d0a87731adf38b3d346a6a1a534000000000e8000000002000020000000d31bd8aa356076c65be4b7218089c5761b0fbfa27abc424ebb7da3207b210c84200000009770d33dcf6490bed2ddacda3ca8d3db89a1a40b197682d26deec2bfcf0c409540000000dd80201eead3e5a1eb02a8a20e1f34f6459cf456bc0fa64913b9240ab1cae9b1bcccfb8891988f4d831a3367aaefe726e74332ec95fa6bb74b58e6ef53f14a11	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d28ddbc446da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411383262"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0603D0C1-B2B8-11EE-A371-5E688C03EF37} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000118fe885e10258f011853904b4ec98f296f9c204397a3ee93d28e27c29453d98000000000e8000000002000020000000c162f1a845078d8d9793d09b9d9071bc59160dde3e561b1fb43aa1c00f26bd4f90000000e0386173f6ae6d0d13e3bc6cbd6769854a949ee56de4ee026ff477b254b8750e921e1c2c4832148cfa118f89468e0bfe5ec2ba5086bc9916d8ae63163d0899cd94a20af8273d61495a6869e1d74e8e765a96b0129bab77e211246b25d3103a1cc787435bdc828f3673957a0392b492227004cbec970e3e1556f9768224644037eee24908a805ab6f463f4705b39c4a25400000006b8863f26a61f1478a7636d586af0d53b8176221ff6d4f056bd6ce9841690ab4a02d159ff3a5037989b7138a2fd17787898177423f5782143b2362b77793a4ff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2748	2916	iexplore.exe	28
PID 2916 wrote to memory of 2748	2916	iexplore.exe	28
PID 2916 wrote to memory of 2748	2916	iexplore.exe	28
PID 2916 wrote to memory of 2748	2916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5ac98896a71419e6f58418a4cd64b209.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32e82a81e700fcc95b8d13c42a1be6d9

SHA1
d0b9854486cb416a911844cb4ec39f30803633ba

SHA256
2a5fff6ca8dacdc18fb9f61a3bb5dfd6af1bce94d4612b28be7c395690b4e87c

SHA512
7a240a2a4570a517db35c9fffbc3a15f47e596db0d44d270b5a047095ab9cd9b10bc64acf21c829dd1879f66b4fb813a4e77a30b96441e63746927e4066120a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0071ab46db943df090b359cb12719c1

SHA1
c192fecb8dc063f8b46858412d41cc81355ca15e

SHA256
8c9326959f74a8203fd10c5c87395546f6ccd739f45d68724d16705cb17e8692

SHA512
66ab57abfe384c0172a4936485beb1e1e6219abbfe9c67c11355eb22b83ca25bedaf4e69ee3b673c2c7ad581eaafc94f773d30829ea0fd3239b468d52dc9d67a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ade105aa360a36635836df744a7139f

SHA1
980180e88f95f118371dcca0960810d1689a14df

SHA256
0a129f078617dc0b03701ff9c62c990030e221969af33397fef433d4c1475ef3

SHA512
760897067582d30341513cb42c67ccaafbf8b71d841fa75accf641b4628310fb7f10d7e4067b9b4ab77e2033c18bb047e017dd029a7d90b9c43b34de22b5d53f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c6ec850ba3a47ed0c39a4e94b572513

SHA1
3df3dce5db3c2130a849cabd217e535236e8b1e9

SHA256
e1a39f323c9210374332abe1ed8bd8a75ee4f424f4458decd06500e82d72887a

SHA512
be522ba69d181c98d23440bafcdd8039c5fef5e3a3dfd70e876116eedee69d06ef9e774bc4d5f8b98927205d72c82be7054a090f28bbefacef51983f9a3c6ebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f2751f5a7cbb13802e5d54e77dd9f73

SHA1
735883ecd3dde8d8871447c813e6ff56fbba18da

SHA256
8c49498c9a485d01f2e497ebfddf541a5d1172fc6562b42537697cb1998de33d

SHA512
36d9c11a69ed3b08e81b91d7f740f825075883c0d9178ad31e4374dbc39271afb4a3f3077f8a569cb45f6ad84092025d8a9c986adedddc9a3c2293102fa1a702

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b09781d27480a5e81a19840d05440dd

SHA1
9649bfe1aab037f55b2e461eb8ddf6f43267dfb7

SHA256
15145e3184501ba5b10a361d74fc6d7edfa55f78e929785d7b12cc1bfe9cdf2a

SHA512
911bb99d6c442c833b26af16b0acf3c0f05a7c01907cc9270f7ea5026b12a5752f83932eee40240d238a9ea541a3492080beba622f14e3ff8628b14450ecb084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e4223f2370cf5487a91b5ede0ab5555

SHA1
593d958f0742fff028cf0622c9618d5dbf8a9b9d

SHA256
0d88c2a2ba68828ad8cfc69bd6f7b44d1cc37b10ecbbce5bfc7b170f6e93377a

SHA512
03a5e4a0c76ac4560278d11d5ee7561e1f8755e60a6e2292b58e5472b65d7738675818ca9efe34898f08d532b245596ca5d5836e131031cb9a32c4b4db32ba28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07763dfc805b5b3e27c8d0d56d935526

SHA1
e9e25bc3f5a1632021cf0dd0dd4c0e822979b0b7

SHA256
0a09557b917870f68460ad78f452b44aea80d8ba038edb5eb60161f059509bfb

SHA512
8e7d14bdad1de85bb247ae950da1f0b7180ff134a58187c0933ad22c6a3454442ad05f341d87a574119dbce2dc9c29ac4e7029d2155dd095a03a46dfd28b044f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc3bbcc6332fc4b8f7f8312e2c200610

SHA1
4f7ba7bbaa9a436e6ad8501b4ae81483dcddfe06

SHA256
afbdb23c937e235a3604dcc3652f290f86b40ee3013bc55e27a52026e212b4d7

SHA512
c18d18ae457ca9216a7d7b04de8f5bb81da84d7cc04ae46845fe4c4178054f03b4e5fb0d581c0281a6faec0e5d512af5c1a08a1228e28720539e0f87f8553f3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
841a25e222c376c34212b5154bbc6873

SHA1
38e846e14fdd0611d13b0486d4277f7e8e554882

SHA256
b11b7d1f0f619f1599a11c5878cf7147065d58daf1c1d0031dcdb5a29c804f20

SHA512
2d8a8ece94888d2e43889a8d3cc4f0c7bcc02fa76702b1e982214be619f5212a57d7caf19716f29a0bb66e397b558ea6c4add4c0b3a33ad87eb2944bb8622f52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
563f693a0f5bbff4a8403268e1af1101

SHA1
a50ea69a4c2a81d3ed1f2ed400b4a06c4bab1ba8

SHA256
4ab48730351c1aecd756772f886c31ce97ff4d41054c359921ece1e8d83dc0ca

SHA512
eb2fc332205aa0f28d9bffb5af2bd00f3b3038d53583a113c3fe318ba62fe6ecf0c107ce71d859dea1072cb61eab89093e0aadded3288d423d625faed65ae2f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e510e3bec70e4d01008aa6d03602e262

SHA1
9c1152b506fc01ff1a132a58b8da02c41bdaf226

SHA256
54b112e3964971e61d356757d24d295f9d73c25d69e5b1215995d0a0b45cf724

SHA512
be17dfa2d7d414c6be7c02facf573eeca57cd97874240a05014e62ab249f08b7147a5b0ee469d41ba5c3998dddd3726d976677133b8c11512481a798dce67e1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e3fc463e4f839cd68e13c65b18fb639

SHA1
90b3c6cdd7990f5a1ade15ce762a2370f780a3ac

SHA256
beab1b1ae07eec5046266ab5be8b8ed29b62c53819ebf4f923738b52ca781d51

SHA512
f62df988d18f36594fc60c7e85e918e0c95f63cd784b182711ce15751e9c43d738a79896913ee0dc52d1eeb299d36f1a0fd4d099ceebc0b3fdbe617e3945f80e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8896b512eb796e8b9d07b0113726d86

SHA1
40088a76ef3bc4be7dd6b72c5dcd0991a7313003

SHA256
ac1e64dccd4173ed63d62f9f0442d03a75544153a07b9551bc7009f87aba86b5

SHA512
01cce51781302a905b6687738ec4b8129253a2de4df6be9b22b9441a8b89bd97793d8582eee981f5a24db44f985e91d89e391644004c69d981b8315d842dde59

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA122.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA23E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit