ddd14c9e8a76f8ebe2c5da079ead67a3958df5e1ebc138baa94ec953ce870195

Analysis

max time kernel
121s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5b90a4dd31a1b3200ea6c08fb2454184.html
Size

56KB
MD5

5b90a4dd31a1b3200ea6c08fb2454184
SHA1

882e4cfb69611940d438c3e23f963ab323dd7058
SHA256

ddd14c9e8a76f8ebe2c5da079ead67a3958df5e1ebc138baa94ec953ce870195
SHA512

df6ccb1ffe79acbfc9a33359c2a1c1c4cdcff0d18ecec10825deed2a984021039feb7688365c9b7e38575edfa94c710afb6d68be9236ad1e4c5095648ca275c0
SSDEEP

768:Zcd9QZBC7mOdM0ZpC5I9nC410obKVi/HUR4Pd:gQZBCCOdR0IxCu1x/g4Pd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b4beec7c9740b6df2464be4eb8b6a5484adf161cc1ab28af07eca246614608e1000000000e8000000002000020000000b0665f0ac7a4b32d5c93ca20921ae1959aff40ef058671a4d8058e1b367baf8420000000306abd9af2a743c44628ab17c2a26b092b3ffb87c2dc537a08d75bc1cc38e6ed40000000684cb703f90525b3548683dfe32fa69c6751b4f55141781ce55d3d5443a15eadd74c5205bd286d49227c1f4ddce56ccb41d97c499559a3655a84b1817c904437	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411419381"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E2E8A11-B30C-11EE-9D16-6A1079A24C90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e2cef31847da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000d45c64505f126532b5eb13a0b9ce9bb2f959b7e36195eba62c0362d0374e6149000000000e80000000020000200000007a7005bee14de77709b89c622c8e42a624b2d17bfd92a3a296f0a3e83362402090000000a05834d5a5952825142d70c7067274cdb15479673f96020c641a0afbd6002683a4f13b3ed198134fe6435498c76d57124bda786cb71966e9b2dbf38095a8ffd1a97270499d6c7c9291fd54bc0305d8f20c555ab47d3a23fd611196b33859ce9d429ba3d0055a45702aaea8310968e5d776aed5bdc49727c72e552e9fc1de37e9463f112c317c3b5235d8b89b544403b540000000e5da4dc9d0fefaff67201a72fc01d490278d4a6d61ac3aade8cf4831d6aa45d2de53371df5658be8f5cfcbae9a099b5fecc3250d3ef4742410e5ad36a121535c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2128	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2128	iexplore.exe
2128	iexplore.exe
1228	IEXPLORE.EXE
1228	IEXPLORE.EXE
1228	IEXPLORE.EXE
1228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1228	2128	iexplore.exe	28
PID 2128 wrote to memory of 1228	2128	iexplore.exe	28
PID 2128 wrote to memory of 1228	2128	iexplore.exe	28
PID 2128 wrote to memory of 1228	2128	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5b90a4dd31a1b3200ea6c08fb2454184.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
801309390db60c1263bfe5bba6badaaf

SHA1
514e877b6b0cdccfe8a73bf76a6404f4faf3a69f

SHA256
a03d959cfbdd1b062ee490980020eae8b3afbca468feaa48da8a40b0c831c4fa

SHA512
8ee96ee3361765cf988f45842535a44f0aae606a7dca3476af19fa32bc38bdf7da25802f036a896363a8c6c5935b0069d76ac096309be4fac4de818c77461349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b3a1f6a092cfec7d9b1016009340c1a

SHA1
8bf0074447a180ae460dd3fb9b78df5e85de6e95

SHA256
1e7f3d172ca78edd1b5269ad0b54d3140d9b571ba762bd5cdddcb3f5b797db62

SHA512
5fb98cc675d52ee0e2c1deba441d6a01c152534a227e376da20c6fc41af5b4392af4dd82bbac44ac68235a67dfbcfc4839ffea5a3a4a7c907e34f0e53fc09136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b1152c62916137300fe30cbb825feca

SHA1
e4980cc1059852025ccba5be2b1110bb93b1d709

SHA256
1f0ee8a6995b68db8d4fec8aaf1dcc89e81875a53215bb78889854be25146cb4

SHA512
e00dec3924257d219cd7bac362ba56f1387ea00b4ba5efe902c85cb670c62edc66be609fff77cfb4f4c4918cd5981931fafdec0b598e352f322c7116cdabb157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
defb4e5ee1b68e9a42b983956233b4df

SHA1
ab6a74eabb966a1c06613ff69e6447d4dc8ca8ab

SHA256
0e789c147ec3f3544c32d07f83de23d1f69a9dc0d736e102a72928f7ceedc190

SHA512
78d82c206c91092071b896c816eb16f9da8d739b1f00cafdcb07e6a04d35dd188357eb6966cbde694c92d6f86e3a20fc13d1c8340830fbb6dc1ae679ac238513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
956cd9d22a3f9450296f3329fdd089a7

SHA1
b5ca71ad214182ce9e1307ad98d043bffc023034

SHA256
81f868b5a54cffd95c56ffe28951cf8184e44de29f471918b19217727de95811

SHA512
db3f485c8ca401ec40fc373be750556842e9a3d4b861588ce909e0e528f3f2d8e37995c688b99da33264a643a7f7d873f21ab5d6b34dd64ac6b1af5cdd3cc0c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
632d39ff17f8fc892669e00fc80a57f3

SHA1
61a74c98e5702bfaff0cfe2c8c6348ac4140b88d

SHA256
7335d05726a2b807dc64d7342eb824708c160c966841e78a756077f5add21768

SHA512
0f534d25033286c7d1418e838640f9c0ee23decd10ddd595c7c0410db5eda95070af81be1450128aadb81345ce1fab6dc10c06c7de7360abb42cea2ad5c680ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daceba1c1fcf0dae4ebd7d6dd6395499

SHA1
b8cddf69a8735147e435407a22cfaee7152be90e

SHA256
18491e32ad561977d8611d4f058fea1f924c24ee7f564cc34fefaf9b66168ff5

SHA512
d95c086000a23028ed3bf03dabcae16409a8d35d7439e8a238c52190701c8f420a9ca53efd667cc7de964dffa633e4f5d80445f38a4d1526fa69f67ed2ebd01b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44691d0236ace4d921e7b7be11cc2df5

SHA1
03f8e48f99ca64cc2bfc0e6151003f9105ad1c45

SHA256
f2168c010f7913b0a904c13dd9a8c2eed2ed72c41a9cfeb44f8720aa641c9344

SHA512
9a520c812d3fa4cbbd9f9e50c20a137226a627443d3d20cf1da27382a53ca1b2d96f88de203c0ea71189330d1eb6299d228c961e7095a3eb1a27a3c9e89efbf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd5c4438680ecfb4b0e12717d8e6ab4f

SHA1
b425a053e92cf7836c3f610e6f932622fe911c70

SHA256
0a7a8892dfec5785b1df37893c50777251d80197597b8f115f5eaf8516bcff35

SHA512
e3e53cae16a2231ed7e2c65d85e344cc05560bfccbf515eb7b9fccf79e34aa825080edff3fcf182846251d5cfe50d8e0cfdfc38b059c06976af658e4fe246b7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ef9778be7573b72020d6261e86e159f

SHA1
ad2e1f2557d8c3ca6fed66476849aa365b9f7688

SHA256
86013050fb472f55a406de993399530c64dfe419437d703c82690a6837c930f3

SHA512
829667d292afd6487d88468ee0d71b4ffa6d51073f298ca5ba4baf7b3c181c4880254913ced27ff00fa150d596397ab83707311eff10131460e81f29f876a2f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d2590038c1ee37cc1607b9e6cb63875

SHA1
2819ca59c3e29deb0bde2be2243254592b491e05

SHA256
e5137c65a68ada21da9c960c1e7978ad158a53ac06ddff3707b1f988fc5b6ff0

SHA512
4608c456cd65b334fa20e672c0ac32a92b1a373dc8dd1173f01559ff8b45d873604ea80714cd8b74dab3bff6ebeeaa37b8a2817dd6306c44db2c0c16e50eea49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a49ee142561c64944cdfb52cb11d863

SHA1
c802a3f24ec86dfe9a79caab8c47e584276763bf

SHA256
7c0a521eac05824459d4aa0bc4b8111fc9d04c614bc239bd81e03bc66e5edcd8

SHA512
95996e7edb0e5a98b75b3aeca6aa830dbaf467e9fdf2d5aef431e0683746fdf72c913a05b0824d6b75611327f948e4dd0c3260b93e07cd74668a025d9b0bba2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c4da718589041868fa7ec63e80af704a

SHA1
c48d453e2adcaabdc84eb44a2ee9eeacf55b1e86

SHA256
7ace4ff17b86d25fa5c631c3835905737c34716ece9197e73a20fd8344d3a491

SHA512
9ebb0ba7d0ee1b86c5be72580129063192c0235dcce8ec60214e63e337209750705d946b07521330f4e69270278c5161e97aa13d1213544bf68ac9a05d3e3e01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f01295d695ebb3ec8face6d4f8cdda1

SHA1
1996fd3b346852288732adcc3dd752750eccc9ba

SHA256
7cb7080b730d0859cecba1b9a87c791618b7ab7f5f37939b73564bfde4e08a8d

SHA512
cf128164c126b16e72e432e4bd4d2b781af2acc481b8ec4858795f4256433982ddb2992b9482495f78a6c50a595f638d38fde18b3125e280fe4691545c99818f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
730b491ceb696aa806e8f8fe8aebb056

SHA1
fa9606d27cf03bdbd0ef1a2da7c87c81968cc36c

SHA256
93a7b33a826d425ee805979666cfcf4bebf85dd8e82591472a68df1bb3c12fb4

SHA512
7ff76b88fa2462a6e9485446bfbd3292abe177aeb9f876d63c0e17afb141bdb7b0db476e4fbb43cc17b5fa82397f7a733dfd7cd670a969e4031f3ccd87fa8006

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae3a9c2795737fa2804f924617b33e81

SHA1
904daf920fd44eeefb3740f7c32ca4fc8a3a2a74

SHA256
64d3623cb28d051cf5f3a1ee0fa215d65dfb972f7cbc3293eb37aa2b5e03f988

SHA512
293c4e92fc037f0417172efc2d86066fa9a36df94e53d86afafe32ded83e43f043d8817e9abcbbec0d90bb35e7cae4601a805ccb3b8e073652512a3257ee1eb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2703.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27C2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit