dc58acaf3a59b39076ce14164f8d585c7137daef7f3dfc36b7b093c5c7c523bd

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e571a5b0c27903eaaf39f5baa794c12.html
Size

8KB
MD5

8e571a5b0c27903eaaf39f5baa794c12
SHA1

4027acd363b5378f7d53b013eef6cc5de986f135
SHA256

dc58acaf3a59b39076ce14164f8d585c7137daef7f3dfc36b7b093c5c7c523bd
SHA512

87205617598bf1c1681a07caaa1a1771b8a98bbf1a8a9c3cbf3500d01f4c313e61c157db686a8f79c68cd7e4ce07b4d6b3e6b1dfddcbf97b4c3ef59ba4467683
SSDEEP

96:uzVs+ux71HLLY1k9o84d12ef7CSTU7yqUhoU9gUdlBdvn99JcEZ7ru7f:csz71HAYS/t5hV9TdlBdvn99Jb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB0BFC71-C31E-11EE-9CF7-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 107389d02b57da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000054279a485f18c085d903d5a32dd2c0e20864c55d05906ea2c2419de097d2f268000000000e80000000020000200000004526475f16436a0c4756a235ac5bcf2d3918639d106f3a15fe2ab86312b630b820000000b5affb7c30f3cfed7a87777c07912637ebd6157b6d4227a3c951818c307cb017400000002920179029b9c7a564e838d45df46ea5b73ad27bc6e69deebcca88b800a2f6f6ae8f56aa87b546d5851b05feab5fa4320a79da8eb1854c8e27a3d2cb918b847c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413186701"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000a4d9134bbae9c88f91777ba06e4ac47e842291c0654d5bc0cd611f58815ed166000000000e8000000002000020000000046995fc12e174d8fc1bed2bf011ed784f93364385deafb22d57161a80b0fa88900000002c1aa40aed52542af6e31f8033b2a8c8525d90dded19aeb048543d384f8eda63515c88d0c595cac46f166548f2302e0ae30f0ee0a6506ea1a86a59c063594eee8b828e5c4f7afecef7a7d75db8046e798335c37ae685894a37bdc0a5573a0d3e36d0dfbf1af807a51998d6d7c52548261d19a15d8d8c692ba240505b9d667bc5d18b319bfbf222d6404b2c319dca8e4240000000e33cb90ecaa0ce10e4e29296b2c063305e41c73f301a8a80ec8d2de6f4479de8d10e536046259ad4cf98be091233e5468c31c8710883427c51c8f5385ab5c5a4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2716	2288	iexplore.exe	28
PID 2288 wrote to memory of 2716	2288	iexplore.exe	28
PID 2288 wrote to memory of 2716	2288	iexplore.exe	28
PID 2288 wrote to memory of 2716	2288	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8e571a5b0c27903eaaf39f5baa794c12.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee500533fd6738580b1a4fc395b645bf

SHA1
c853cf5b691221ff073b19d58bdc135311626707

SHA256
e19991801d8f8eaf739dd2d6e98f72b6f038aab558a8028f568c525fbde63e81

SHA512
f61bd0aefb7ee6695cbcf64d6474aaf231b81eeadd37f9e36fef98ad308636752e3704002183ea7d30ba93a0ea00d82cae5aef84434133f0c4a934d8423b98cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
025bba851790ae1f5070c5ef292385b4

SHA1
f5f65199059dd11d957cfd89970600ef9847f227

SHA256
c7c277a81bf80f79d120683f0940f4b2db6ff12fad74c70c0b4e0d511cc17454

SHA512
9e129d6bf00651dedd920a379ed7c34eca250b94f5e80cf1f0f82d89e141713316c4e322fe87d0a8e11ffae4a0a83143f7f315a8b5ec1f31ba06980562f3ce03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08968ec8c325ad583aa44ba8cc5f74c1

SHA1
5d92d05e28442aefe2e139775de2a0dc5443ec5e

SHA256
b02d00f0d3c23d73bfa36110a797205a11dc553dd46edc9917d23102ea786f47

SHA512
b83e2ed12e5a8b6020f453a586deeced6ce3eedbd3a2e7a5e5109fd6cdf674b89c1925ee2edef2dd38da47002ee56d3587c3ecf07500240334a91f1df9b1de57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c7c8b857080c404db70838505865389

SHA1
3c4346cdfec63e2037f67d4b5aae55aeeef4d58c

SHA256
047a8a1ead76f74c9d12e7d61b5b3c0f1dbd688d363057210025eb078429ec09

SHA512
87c8b4263237ec1a30ad2f0b1e32b7ebfed0460938ba76a74ff6acaa63d35ed5f4b0f417f8d3198c6e051628db8895094994ee9f7a8008d8eecaa24e27007c69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f272ff5d5f9fe3eb431c3f143ab0a0ba

SHA1
30fc0f75983d103b34d33bb499d1431a3e05542a

SHA256
94dcba2d332fd21c29db7a5ce71ee6bd94fda575b47630235f60fcefc1290bb5

SHA512
d45c38bb0abd6652dc99b8af88808bfc6a7856a214f888ca1032b2ae2483e6cb8b5d7141ce90eb2d474ca34012cbfdb10664a28a9f58287803f6c6639f900173

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3811f655ba53c3b66a6562ae83d7bf7

SHA1
44c0e49cd63ac80f8d836ddfcb3dce5467a853d5

SHA256
8bf2b8bd1f023d2115e795ce0d56efd9f2abbf90ef72bb9375921924ea9eaf8d

SHA512
06c965291ef09b0769cb5a5bfaf86b245b49776cf12a368cbd626c2ba0cc1984ec96bc1613eddcbc3c9bc3bd9cc6d8a428c4dfa6c0e24358dc6f03376b390d88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc919c5cf6bd4fa09173845324b6fd33

SHA1
89185389db97918022d0cee4d229af007d8bbabb

SHA256
2e625e1d970003a19c06772206f8ea37e1d5834cca6067fd0aba723ca7a445b2

SHA512
ce35c5f369234864b49c5526047c00c32823b464fdd82a775120e62f9b9db5c1fa3813148637bec55e15cc19fecddf78b41c4196ee88fc8a14fab506c3f3edd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ba6e1976a6e355abd23dcdd00c71a89

SHA1
a765cb9cf6be729dd5b0935d5caf6422ae2d7582

SHA256
8ff7aae0e2c0dba04ae5c5b9ec2d756682aa068409eac4d9f8f1398dcefc4ef5

SHA512
21e06fd5ab305952f227f444e055817b1ae4e6829967f7a85ac0bc34626c9034d33fdd23515c53513660c6f3676e4b9971167698f92645434a4508b50fa61d16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3776bcc0fe140e03b4f9cc20cb07732

SHA1
18f11d01c278576ff3fa4903eb965d85cc0626bf

SHA256
450092d7825619288aedd6beb84b9ed88ddc38b60aecb3a520874c8ab4b84175

SHA512
ca6f8380181ea98393de8ce797d67b18e26f61c0d566c205a1c200d4deb4005595f36ba7adf895615abb833739bf9c053d9a407ad795e886053da4174ede528c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d7e8dd6c5f58e52198450b349bcf6f6

SHA1
5317fd0594d300244ed2aba384b347bab909f15a

SHA256
d31531d74571c74c3681c99116d1ce9e77cc248b7a781cf9444faa94184e7580

SHA512
aa5af9ac6a6eeee3c76e9d250a73e96179f713006bb81b85951619acf94c366900cbd361bd8f914c7b57f1f912b606e035d158ce9eb058f4290ba3f4941a89dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2598c0a6d228f6157dffb0d01a83f887

SHA1
43c7b35f9b550bc3be3e08dfa2a5a70464b7785b

SHA256
775188b64bda503efa0220c13091b11317dd4a8be7ffb48f19d67e768f7c4175

SHA512
32165e9a2ec446a0aceab57458c0d09ac2ba8e998e7d385aad048aabc7b04b950cec5609b774a7cfa7fc1d37bb7f9c9352e50b59e40de545aa2a7ba8e517303d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca44b17df303a195466c86c11a4bbeed

SHA1
5130b6b643eccbaeadc25491953d17f020999093

SHA256
5debb9cb770858045b85f8178c555b3f9fdc57e64d245971f9a962f669f594da

SHA512
0ab216dd3ab5651eb4a03dc02e7b032b5a358dffdffa2c212bc23170749b9af92613d480fc420a332d2279d11bd610f1be57cc277a2189a94a21a33879736364

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87c54ad4a53f76b81ab6d7ff78b1fd4f

SHA1
6c2d0d28779f1bad15b3d1d5b10447a90e0f03bc

SHA256
30b845ff338db5bfe3f686db78681546768aad717bb710e8ef0876de897aa692

SHA512
25bf17ddbe487a114285afe23536534fc5afd6e8efd190660866a726b9d4e58ec6de618cf18b77a33dd88cc8aec81474c8a1173bc795be214bc67b0ab49bf30f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
878020b121e0af3e4f4aaa2470e7e1e9

SHA1
a67d29abd1e29d2dd18d44996420c0a346fb8ee9

SHA256
a2c6e23054fefc37fdaf85bfa390140ad742b722f92a41feff21ef3aef007f26

SHA512
5716dc0e65776371fd9d53ffd56eae0fb0da5d03477d8a12a60cefcfbf02af322d5c1fb90311b86f3b0c1046bc3c0f665dc2e83623ef760a488fc6032a966cb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d66ad361957f943fdf8100f029c2f29

SHA1
a67725a78fcef8d908a1102032a5b69f9afdb806

SHA256
c17048f79de39020a05c93e2b3a66ce23d5857ee34540a0627e306e875a3e182

SHA512
3556c3e6d010f8edd29f914680e0cd36fbb03be0e4eaf1c468f96e78af966b6a982868400b1b17bcefce2f623fee6b261cd909168b024a0f97b0fe570e0f2949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cf63437d611f24097df8ae754083fa6

SHA1
b4747707b24bebfcf7b1f22a9431221ab774c800

SHA256
aee6bf9f875a7d560aa9be2e30522d0f27df60df5622f6f0bcc98b946d33f5ee

SHA512
d2a326410f25ed372847dd9f720888b2b55fc32a60aad6ccb12c936450335439426bf8a6ec0d3b78092aafa30982619166b5c7c8339e1f289b20ca19070fbfc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
365a5feba3e47076c9da103e2b23eb9e

SHA1
73a9f951550662e312051e5bbc9a71a481e5d9ea

SHA256
62b6b3c7be92e78b55bfa4aa568519f71919ff603c0531db0eb3276b6e58ac81

SHA512
5ee9fa4ffc8633f2e0cf5d8ec7f86cfdf11f9ee1c923add8d019d1ec135f047117ae90858a8fb189056b2aef8c557b664d2cf736e3900162233ca960c0df4759

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5728.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar57E6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit