e33be8a5f119efdce1d91382e5f1b750c4d588d18fa574cebe7023d18a84eae8

Analysis

max time kernel
136s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7bdad8015119c8e6900efb6cade08c07.html
Size

53KB
MD5

7bdad8015119c8e6900efb6cade08c07
SHA1

a2121093a01c8d816b9a702d6b6390686eb596e3
SHA256

e33be8a5f119efdce1d91382e5f1b750c4d588d18fa574cebe7023d18a84eae8
SHA512

5578cb952d942483286f52939ed0d7afbcefb1bffab4b312746cd2abf729a7975053c84dd262bdfc0fd888c9225dc499871d5c2e55a857105df0615ccc714287
SSDEEP

1536:CkgUiIakTqGivi+PyU3runlYw63Nj+q5Vy0R0w2AzTICbbkoN/t9M/dNwIUTDmDB:CkgUiIakTqGivi+PyU3runlYw63Nj+qg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ec638f8d51da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412568975"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B97E26A1-BD80-11EE-8073-42DF7B237CB2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000500ff327e4859792b101f1b93e96f5d866d53cb9e33e267287fd34e11e0369f9000000000e8000000002000020000000ff737c61e2f95b16304832081f5d15f240f9200bb1e4fcb9ec04d03c28cb3c2790000000bb8749a1615cd93e5ad2635ffee62b78a58b4abc25c5e53601f1b2344ec5fb7d7dbb5d082e61fe328f3d5d9c5fd0b87e6b177f734b34eeed7b3973e406433e3cacbbb974947cb83e61f6499c886564e5c13c28850ee02f48350e2a01310d0e5454fd3f6c1ee86b043b48e5bef56800f80f00b70dd4bc859baf18b7651d0d36c9b4dcd0c1e7d8191c95e92e95b2c42bdb400000000ce647342b02ff17c0ea8ec2969a03d3202c7e0410277bce7dd5e1129ccb90f7548cbdea4e2263d65901d4778926d28c51c63742f20b35a9929eab99c2b0d08f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000801b1d6d06d2b12e61ba2f0e637dc4538d8f6c00359c45c20961f38e56d30ce8000000000e800000000200002000000033229746347bcd77d09da050498eb22eebf06fcdea58b0015cffb570ceb89ae0200000003603b02013b39f8203ed3b25293dde089ec6e21db608bee7b4ab4720b4d99ccb4000000056c883acf00cd0f8dd29efb798529a9fd96510d04ac752129a1f5210588898186f74e4e082e5191ff7dced9953f7893da6a9769712717f95ae7eb1b1d23acad6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2468	2236	iexplore.exe	28
PID 2236 wrote to memory of 2468	2236	iexplore.exe	28
PID 2236 wrote to memory of 2468	2236	iexplore.exe	28
PID 2236 wrote to memory of 2468	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7bdad8015119c8e6900efb6cade08c07.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d63f79e2572e74f4837ed8804d6abc94

SHA1
9ab7fb4bb9f3d6026ed937f444733cdb1a2d0380

SHA256
6b683ca7a284437804b1d47e6e37d8ec2e02be6e7a852ef3641d9c021e81d409

SHA512
380037788b05987be36bfe5a7bdd4a3328cf76416b7f3cdf1b032508c8d511cb619683296ea7a78fae1766322b771e0ba4608ffb87e1169687985f371dfa51ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e4e283d766e147c45d870bb1c219dbe

SHA1
451d7fb8069181ad1e5e29c2f5c831d4e3e05044

SHA256
0f9a4e85372140362e97ee126faca6b0dac602e558971841b0152ce146dfaabd

SHA512
e7d2473b06c58bafb91d08324ea6cc737a7bee010a776994ab4c188d6c25967df1c6329e3bc4cb08781fc43dc9f131d44f1dd26c2706c0adb6496c4106bd584d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
daa80c053abc6b42554051320f2ca22c

SHA1
6106d13f30bb6d3adbb70dee59131373f7367930

SHA256
753be03ee5f25d67c1ab2f92e13d4b5deded84fb768593f70eb137ccb183fa48

SHA512
6b45cda5c4dcf82458c67b7c5fc9c99a4c2e61ce2d52eaa614192784bbe03c46571c32f567d8d3a58a5495a6d11e047f39f0956cb3021b91d9f3d4011669bd95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f30f0fe545a6f69c1a319739645045b9

SHA1
09fb6d3126918bd515634a6ebdbbcf97e4571e18

SHA256
9a8d780d8ef494e4589735087977f97d1f9a2aaefeca79f6a85834a7198d8b7b

SHA512
2bce54ac1b282f829ee61ffae1c7f3a718ccaca208256a8754f4b2a19320b4c162ab5a8bede5973956afcb8e96f9277cbbc46b9c165adecccdbf6672b7411667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef410e081b2313ed57aa6acbf49c8682

SHA1
4f2428d017bfd50b7b5ab88fa9bc5d5186ea754d

SHA256
cfb57fb3a961d3a0865fa5c1685addd0ca86eeea89ee2c7f67e119d00f5e92f9

SHA512
e6bb4d13345b9871fb28c6399bd519895ff6e84753042bffe5155efda2a6ee4f1b46393642631aa6fd133027cbe81917d2a39ad07c0bd5acd0c36ab428b6b945

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34b671a158cff6eefa2eb445357f60c9

SHA1
fa3fd337847a51ba22f9f9294d9897fe2610d402

SHA256
d6b7632b2cbcaedc8abefff90e246045837a965cccf56560fc6a98622b8ff37f

SHA512
7b96930ef8d8974e3ac1b1e852a33a91579be9b149ac89ec3385b70aaa23552830c2fb1709ec16c3ff671b3f2c1f38ea61fbab7ea6d985ebf25057d44c8ace9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1078499e4351e5449520f562c4b91069

SHA1
aa9688572c64da452b14c8d0b035e582dd3babd7

SHA256
d9c3c6a128d649c43ab0e3c56b2992b6eae3471270b7178c318fe2abb6878e73

SHA512
45adf72ebf9ff3429aeeb87da34514e4af8424ab848a8b30f1b3be843e23f570eea564814db8fbd25d13fadc07339c9c28eeb97b8e9bba1066d052680464664f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f694c061d390abcdaf33be62586e118b

SHA1
aa900d8203ccd2adaf538f2ac06e25a3de080f43

SHA256
a4aa353dbfb1b8a11ba78c243708fc0c13938090d93c7fed8146b0dd3744335c

SHA512
663af4964274538b0d264ff3c62507a10c59b2750e789ad9be0d33a84fb67c4839e26f655dfb3b30900caf38b564398873647cc349b087ae8f59fc8676b7584a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba2014caf7b08fbc3700149b13e1e8cc

SHA1
789e18fa1478120ea62d42cca2a1b224d3d07a1f

SHA256
15309d7c4ef79917f26423f066d17ed7c02037d23697f2a9538db89b06db5dff

SHA512
918ee490cc050e0145ed060b57a2d758ba5e8db5afc648f0474d412f66fc3ecb46c16d944e89ede582067b613b7ef6ee7f2dcfb758dda956496a91accd4a2898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
321e459ea0a21747fa3524069ef2ee12

SHA1
33c302ab03321aec18b157df3757f5c70eb0c981

SHA256
513576aa52c32592f6c66af8775e79f36ab7635114fe261088feddd20e284651

SHA512
2d0e09b8076e63f8fa708dc12edcbcd88304b686aa0337949ccca9cb309b4069114c8a40fbcd8b6a84386da3c299d7124721f278357e0133c33a68d70e0f5454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19b5d0c70d5955ee4813aeabcde4e51d

SHA1
1ad4cb81f231c2e0069b5212b896a3871735bbda

SHA256
da3ce60aeed86739cd813b73a9b68f97fe264c00ce92ece2d61173aeba006e11

SHA512
9f4943022f531cdb13e9353f40dc6cb8dcee368b1a54169eff9374fa2267d3eb53ee003bf82bd9515bbc1c5708e7fcf594c7f44a1fa5296cd5a446d987ac1dc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a94bbc88ce0584632cb5985e3236e5d

SHA1
3a6562b949589390d3ca82bf8821ec2a4507d263

SHA256
20ba12e042bc313d22ec947683e2cd9d598dab52dc4e0b5e474efc303f5be60b

SHA512
02c93756755086ea79b7fd6e5bbedcc353546e78fff843f57bf61b8244ef03764e54bcc8b7324c86576295b690588c29160cf034847669a11631d02d01212c5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
136f6599f48e179189fff1643cbc31f8

SHA1
d39c14cfa02eb4c536cd41b51fe2dd59486272dc

SHA256
a18015ae8d1f57881e7383c2231e1cfe2d509e35af363aefec79cbe90973201c

SHA512
85f80b308df0e6867aa7d51ee4b96aacd329b9cf0d25e426fe5885c1d436dea1889cec0eb77d55b0d95f838f92fb47804ddffce757053f81052dda77109275c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08024d39c834d76073b352b94636cef9

SHA1
bbbfa78dd5de013109a766ecc0a6ac2f8068b185

SHA256
02462afdcea9cefaa5600d112b9255759c880b50a7ac99d7775f87bddc839303

SHA512
532569e36d7b22b8a908e013e00710f524009c6ec2a80e84a7c28ee6b75c24f4c5d9d4ecfc4071a0baddf027cb9ca380b78b033961a21aabda2a6981dbf09fa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27f8849523e5ddaf0a8e9d84cd567418

SHA1
c15b344d1707024d628b9e6e53f1c5506976d600

SHA256
2d54a06f30902bcd2c13ffb27fc10d86fc010ec2d54ccf08f45704d50eb0d93c

SHA512
f9e605c07bd033f9007d02928da3c933c333c6dce3f3b044327d28d0527235965e32ad20869c181deb7b67d3b326af0ad08616608152de9f5ce1a380f206872e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab76B9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar773B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit