e355b9ee9a6a22b477e0ac64028a3cec87f1a36c26b948d942e19cad6af3f347

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 18:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65c7da77a4fb9adc3af5f7f91d858c15.html
Size

9KB
MD5

65c7da77a4fb9adc3af5f7f91d858c15
SHA1

8b1df5f23f256e938d8e35bebf32290065d484e7
SHA256

e355b9ee9a6a22b477e0ac64028a3cec87f1a36c26b948d942e19cad6af3f347
SHA512

aa11dc0903eb426041cadffc2f749cb4283f664f42f0d8b22de240c4fe185754c93180320deba5e7c8ff3de89529710e316c2a000fb18769f0f14d4c922b4676
SSDEEP

96:uzVs+ux7N6LLY1k9o84d12ef7CSTUrGT/kPsKpUlVHcEZ7ru7f:csz7N6AYS/6LUPHb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411765932"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f041dfd33f4ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE86E751-B632-11EE-91A2-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000004c49528c0355ff62aab37c8cb24f8ef524437b64667386de961be367772e9f23000000000e8000000002000020000000eb719bb9e6e1408095aca1658d6460610bdc7ed13f872819ac6b8393872233b1900000004f0b4c9eb886872517f8d790f61a6d5e85cfa1037fccdb735ee9b48d5d42068b5024e56bed637e8367181d30615b4f8367889aca597a7e90558af3d542477d553764ea5ca5c78f40ffb788fc93de6d1045194cd5a34b43659ced163b691401747bbdc378ecc19cf38aba60a59dcba82f4f321d4fe5968e4145bc2cc1b0eadeae63240ca48dac5d1b5e6548044563ad474000000052120468f2c4293e3b4673de864f65ed18c3dcd47a3eef354f29964b5cb85465475c18f197960d21e45ef932788eef5f0ec3e174190a88aac118a416285619e5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000f8805c9a6da7b5a269121cb7da1d0784a8249d17ceb7228fba780978b675f53f000000000e800000000200002000000055aae864c49b707c8e3a496ff561973da583ec8ce389f054af04f91b31f98206200000007d6be59fd4cbb844fd75f8276a6847ca9999631b1347064cd130fc11b1a816fe400000001fe8dab3b556ae4bf948ef962c433724d7576a0c7fa98cd4bd3f5891283b63c32457925c5c8b31f75d4b3b52fdaeca2d4d779085589eab7561c32ac06bb90a84	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2324	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2324	iexplore.exe
2324	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 1724	2324	iexplore.exe	28
PID 2324 wrote to memory of 1724	2324	iexplore.exe	28
PID 2324 wrote to memory of 1724	2324	iexplore.exe	28
PID 2324 wrote to memory of 1724	2324	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\65c7da77a4fb9adc3af5f7f91d858c15.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b7a75ebd4ac0c4afb87b555d6329104

SHA1
40babd88b0db4b5d997fecf3b880228bdb76c872

SHA256
79f7b9e4156b382ed213abcd3093ba1ff465c667af567b2222387962068a477a

SHA512
8182e49c75c4293915fdb86a779cabdcf3385bac3812f888f55b7f171649a3f960c4522fdfa0afa9ff92afbf1704ed919ed8691dd6a4a28c860edfa09110d3b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6c92606cf1cc546215e4384938394de

SHA1
0cd8f50b4b49b5fae9bd2ad56739d5985db63e45

SHA256
48fbbf7977d65b2f1a84697b5c01b0b374a3b7f08c777092477037fda7d1df5b

SHA512
cc3163dae826d0dffe550261407153fae90508a1ceb8fc8c9130abd6b4ef39704c2609599001133c69679b52f2f44e3239d9a51f166900ceeb7976e48f43a34c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93406359b414602568a70f513ec3a190

SHA1
6a164515a6242244859afdac938015aab91fba5f

SHA256
ccbbe400bd3875f5e8416a23ac8303ca0bb584b76653bf8a9364163f0e09aa91

SHA512
aa64ea98be7e7b43ea3e114d7d862226654f3e236760ec59506a271475462f176f38fec06567b819a47cc23d66b5fc16ccad6ae652d5baf57c2d38abd6a3d860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e057169b7710b4d27a0d1765d010330

SHA1
eb50d4958b2541e43935f0eec68c86c0c83432b5

SHA256
8770022d7b6844da57159a96494926d77c74bd20e3bf7c63b82ba38b5b1d41ed

SHA512
5c084fe63875348ab813773bb874e4aea226e38881bbe52dac61e6c6fd371cd105bf002a9b574a7b066bb8a76df4d24a6b447ae91c4eea2a832add731d63b93d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f67bcda6a4908cc9a44fea94112a5609

SHA1
38d50037a58b6ea257e0565cffef72e7b3c27552

SHA256
a851607938d682b0253bc09f82685236112eefa59c2a79b6ee65c397b7184f51

SHA512
2b2f392d3139b14782ea136e22c49604aae0799af7b9c687b5fcac99080c15ff57e2d4c627e6e0412b3ebc07138483f3296006bd8dfed564a9ad7afef0e0921b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9623e146740b5ebb83ff6b9e296a93f6

SHA1
4e8d6c81c44095832d82d41008e4b12e071c1353

SHA256
68514d300fdf05a9ca42b501c8a82bf150d67f99aa06b764001b2deaa07ad61a

SHA512
1eb6b4127a4ad8efe153001c27630c901a37526eff8b582434d2385d5013736682db3e9925c3cdaee60252d26bc8e98a4228e61815ccfdbcef29c6c3b19bfa39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9f17a527c2e8ce94d114b307901598e

SHA1
af7b37e699e615a09680058d20b4df5bb5181278

SHA256
092b8d5b6a39c6491759bc4c6155bd39785f45294b20108512ab067af0f636b4

SHA512
d68712286a573d7db792c48e0b8e7b451ae8bd8c7740fad52d77301bb41d093a436c807f98a36d1a21453cc68fbbbde854ed0b45924aa76cfa896b7025126c43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fab76e773938442a5dee2d60f3ed49f

SHA1
c6b964ba61b9a7467c6aacccc362c94153800519

SHA256
1f5d780a693ff2cd4a2dc2f6166100e5474247a24421e8174b90372eeabc928f

SHA512
4a98c425e49b9fd26ebadfbcf84b9586da385a46ed57f4652b3c679ba63b7d37776c3a84c128d028f79e80eed91ac4f0dc1cdcd7d20812bc68a110aa15fc3b52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78de4591ce6cbe773a3446df476a5a84

SHA1
08a185d7b870d5d98c01d876a394f08e0bb00fa4

SHA256
1dc240ab74e3972eea1824c1b4de0908289c5f4d57780ac51c09f9640a4b9f75

SHA512
c00c83c2e4adf3977d295e96381b710f609592ac30dc7499e9dc34c6d7c8bd00284b12f42b9f5f927affa4b9043220177bca435c7b1f67dea66acd613f9fe400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cd7e6f4658866fd591d7b60da1a5c6f

SHA1
03271c3d725ca6dd4cb64f33cb50ef8bac2a5963

SHA256
4fbf0785fe9067ffc13de14c304c7e517eb202079cd282d76b62d88740e95883

SHA512
406682b98cb5edd2d1f20501dfa911de21717b0e61bc91a4742ba0beb542c1771c0cebcf33dce488025683a09ca07ff0ec490545fc44386eefe186f364c23bb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab51D9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5299.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit