e6f37d7edd8b204dd79a56f5ba8d7d1c476b0258cacd00aa1a460533257839bd

Analysis

max time kernel
142s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5be84d941479eaf5e1f4efefba2ed605.html
Size

90KB
MD5

5be84d941479eaf5e1f4efefba2ed605
SHA1

2264ac82d66d5fa20995edc94dbba52d8ef444cc
SHA256

e6f37d7edd8b204dd79a56f5ba8d7d1c476b0258cacd00aa1a460533257839bd
SHA512

b232ed08d7a9a6b9ecf0cef028be0b43dd0e2a10c2e821c0b4f72b150c3fd972d314873672e94e964f8a27fc18817ac00cbe005f171f1e7ac6ce1fcbd7b71ed2
SSDEEP

1536:gQZBCCOdN0IxCK2toEK0EotB4n3zetI8bUklXVnMCIAdcLkT++z3drxilD4J4Fw1:gk270IxCPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411447938"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509665715b47da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9BDBFA51-B34E-11EE-9F40-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000000ffd50ce0bba92a8895ff471c86373a0c92586ca3aeec78cbd9da4bb9db5a1a6000000000e80000000020000200000000f4e1d239bfbfce2205e49350b390b2af9cb782e8a9f01193987bb9de76a339720000000e088ed8d3c6513ff3e84e577927641d21d3b6e7c44fb4e8741ac1e6f35c2759e400000000638d7fab7bc9cb621ccc492eb2821648df0cd0d9bbdac915c6cd09623a1ef7dd613b39a5d96278c47359756215ebe0d5b34efb9d27994eaa01bee2891574fb5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000d94b8c25a90852f983e36a17002a079af6d81256768a2213d3c6a61469855dbe000000000e8000000002000020000000e076b3467bea7ee97c9857901c6f90d250a90bf68fd1f96198fdfb754e178f4a9000000059d19bcd3f7db47fcdbcd0c982f4a8edc0e9320911c6a84c6f5653401963fb3950c5d6fa3ff36be9f18e981d6f6322332087432c1bceb4c34bb80eb9a9ce54156a50ae2e956dd99ab5df5ecc0f835e76b9e81253affb4f66a22c5fdd200b21fec5b8bfdcb387e40f353cbc41e0b3718df24530eb3b6ab3df576a7c667fd9fcb9dd90f6e807f2e0784ceccdba77fe1bb34000000087448f18baf7921a2fe8120d4db1578ed8199b07945e952f7d708aec6056a9b4b51634e9c02bbc99a989bf3ca56e2ba8bf9afaccd2ffe632aac5975a91411740	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2944	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2944	iexplore.exe
2944	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2708	2944	iexplore.exe	28
PID 2944 wrote to memory of 2708	2944	iexplore.exe	28
PID 2944 wrote to memory of 2708	2944	iexplore.exe	28
PID 2944 wrote to memory of 2708	2944	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5be84d941479eaf5e1f4efefba2ed605.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c6b8267ad2800c94198deb45b21e9dc

SHA1
0a98d25c3d393e9a16ebb444ca6e2194911ace60

SHA256
b8fa946e31c7c0827346f9593c148fab23e5b44f90a8e1c9291b48cbdcb98409

SHA512
b57409093352d918fe3287e920393656b56f738b7a4e378d477076f097a452add5ef1e94098a036b63d263b917c85c479759e64ed210523f5295dbc28e586f24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd3c4092fa7570fea703054565545889

SHA1
07d9ebcce8017fa1345a55645c3069c852fc0274

SHA256
f7e990f86d91a6776dc090ae429fa2a6a3fa7646963a75abce1df6b1438b550c

SHA512
8c3e481d0e4d5a8db33d214bbcd6e54fe82499d5a77c2f2c16824a75caa9c03e617731568ed5561088ee47876bf8ad1fa1357d6c032969d18312f55a1ff76a44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3106afd2d8a71f2e9360fa5c10b59f80

SHA1
b7513eab0b40602a490ba944f010ead0a067e5b9

SHA256
d11947de4b72bc90244760d72a32a511e5844156cd02ef26ad6c5d3691d2b44f

SHA512
99a56c2f45afca2afd17f395dcfb65995c954c02e80e6a45b36747fcbe3bc46fc021bebdf2d01de7005d0d31bb7dd1a62fbbf5305eb0c8ac2624b1c2d05276ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ccc9122cf19c520f7ae0e2c9cb45d4f

SHA1
5eae1cc641b1fe70747942426234899d78dcb02c

SHA256
2d84a55d68c9be5d6e9d35ea6099b9d1c1a3e9179f1cf663c68296d94209bb4f

SHA512
321f3e6af60235de9d31cd54ab0dcca1745b6a051637e3e753cbc43128a243e3bb583b2cb5d501421e5fc82ceff9dd7d39340b30a0bc176dabdbaf43b711f793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c4ec61210492cbed3b03b20c37446bc

SHA1
4a5a8cc26a6b840fed28c4fce97604702053b798

SHA256
cd712fab3c66c0e5fe8e66f3b4db0b9d5e79a7f1d75dd66499f24fc9b81aa186

SHA512
08bbb511fa23a635a999f0aba42ccf688f974760360c452b33ff38f07e9f84b741d51dc0748a0082c379b15bbd1dab29c75ff48e8359410ddd0a46ee17b464d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81519b0c2ce5d2875e0a4fc5e8a26069

SHA1
148056bf33e4fd36c334c4945710a4ce01b4a5f7

SHA256
07b736ce75ffd48d61cb0b323c8e945eab271346862c8ad046a385aee1486c80

SHA512
a417c49ede47ae5409f42f5ad31354ac30f6811612164eaac1dbf5e43408bd1348487518d8bf02968df3ddc6654d2ca6b9e88b0af26710e9708a7782b8c8a91a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a632e8a1c3b775c649522188667ab906

SHA1
d5f8b976a95a004290f267f87d66a701f2edf4b4

SHA256
645f75eb7eb9bbfaeeb451bbb371f0ce50db0a29b389998b6bdf943d5a3ad137

SHA512
eb74df90669ba6f056418d5fd64adad55746f45f18913cf210aa78efd071b27f858b86d2a1641fb49380101aa577d1d590da5675698a8ace166f897bb6737366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5428626eb97823ab523c6b6b2be45a26

SHA1
8d03fa518eb765cb7c96af1a530b40293459ad63

SHA256
ee0115a157d20a5b47652b9677492e58855aeb0dd5779620706be6da2d5e279a

SHA512
bde37fab14ec33909be8a860f802fbae861934e92cd97975ea223b7d852ae4695175039011e86c4742ed637290feeb9fce7785ac80a9e84d4288f09dcfd33ffb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a669adeec6b7378014cbc89d2ae81dfd

SHA1
d8dc83447f6369ce9ad601f80eb7ca77ca3b1b0a

SHA256
7410a735b33cae3ddab5c83772f755758d9c262abd586ad58960350d980786cb

SHA512
4fbf8febe3efc032c96e15c0357f877b54092af83ac1827939558dddab26fe65ebd21297f28690b2315f8602e3c02384288a950a5abfaffa122b4b49b28d4073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a703a8464f3dc6254c95434e7f42fb3

SHA1
d859f8e6ba081af4ebdcc437fdea2a93e561843d

SHA256
142dcad4ec5c49e74110881411f176f73575915167f09419222d1110ae72e913

SHA512
ad03cd40e0a1d581fb001d1090ada0fcc9f6d249a8c8baddb33439ededebdf17f7b16e7f08de5e06fca766ed36d312c22bef289a2fbb305f9613c079887c2735

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f85dccd66731d2de2ab75e4ac7982b2

SHA1
bc517d019b3b6508945c9185b45e0de917a0f059

SHA256
4989b87036d2a75137075912fc3dc7c644d26fe7d036e2beb2a1fdc178d3eebe

SHA512
568d8c0d27555a5b64a0a94c987d10a7be8bc59d7ed5d40e148ff1fc13b3aff3ba4ef094bcd428885dcc0d0e756e3b4f622da848fff8e0f6e7feaab87c73ffe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c00fbb8ffad42b76b17cb6d88fcce53

SHA1
2cbc57a6e14636cfb32c0450b0ad0c0b72e1c4ac

SHA256
2d8e0fe7ea5f999c2fe25ed9d9dc071d90ceefb21344e5ed16aca750d052e518

SHA512
1f309dac79c4552a64218275d85498d12082173c2a527291555c430dea6473f35e687d323acc526b06fa119222b954d9ebeec07d7e04249c785a209bb9c72d24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c73bcf87439ac478954fec9607ccfb52

SHA1
7ebc0b36be6e7c7468d5a8df21d3d237d4ac6246

SHA256
e0f221ad328065a257aa818624d97a62df009b89b5cfb3534fe23acdf6143ed7

SHA512
9a4825bea531421cd77a2309ae7c9bf1ed71ac46b9de4d3e87738675b9b4db9eea83cc12af3ef124fd98e5511fd5927fa4f23a3b510de52574cb799be9062897

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efe885d7d84dd20ff3403bd4eff95c79

SHA1
7ca275fcddc4fb1fa3c99b386081608a0b6c4b28

SHA256
b9f3626b2c8787ddc9a41350838cc5c0b04858b10fd56cd7f83083ec1069ad18

SHA512
ec24958ab0011059a481bf38c199d66f72ceac927b01d2488e02a6870aa25b8ab3d5d23208f79ed22dd5273ff3be6d9556dbd4a7ae6a883424658ffdb938c962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18f9087cd98bbb9de7fe527f53413c32

SHA1
8081c02446079593b91a712ae488e7caa60445cd

SHA256
757610ed3695c54d8ec1dd9a0b526373c04d5b6b145cb066e45734c5b002e3b2

SHA512
db89bf02eddc3e987c93b8b9d871a8a2a18b07a46673c8d472e9686d3d543fee52d8e653b67ce3f821061f34b0abcd2afdd87c310fc197132fa30369351ec3a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e4c46d888e6044d525b89e75229c4d5

SHA1
f90ce3275b18f3c1250873c0474c6b7fc623647e

SHA256
a930e51de9a172d4b64042ceabbb140a7f6dd6c945badbc6854cf99e9d669af5

SHA512
a8c8b94bf9079e2ddc55db9e2920d74ea77a7703d03fbbea78f3ad441d9933e9311ac8c485734ee45caaf38f83f4663da266b383f87f1f7004299b5cde05008a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8077.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8195.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit