ccc3088e39261f62dc28d80b75f02bce37db89bff06d29b6c5c0c84ccb09f698

Analysis

max time kernel
66s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bb0b91b4f5b22e160a4bc47207ef951.html
Size

25KB
MD5

8bb0b91b4f5b22e160a4bc47207ef951
SHA1

71a49e27e17c11e6072c59bd5632ad0dea848e63
SHA256

ccc3088e39261f62dc28d80b75f02bce37db89bff06d29b6c5c0c84ccb09f698
SHA512

839617aad28e7a00a8a0c0c0d1af7c65e8f306611228501f6b85f2a8f629ccf711578541345f62ce71c616115dedd33c1c44c3990ea191ba567d04732c1b9e29
SSDEEP

768:xy1R1DeCUOgR1jBDvhEvh6XYacNV77OOK:xy1R1XUhR1jBDvhEvwXYacNV77O9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000e0595dc78fbff416758405b5272a61bc70debf8832a18c61cd2391bd3ebe45a4000000000e8000000002000020000000ed68b16892f633a8f06fbf34b6bd3df560307c1b80d3bffb4aeae5f48e3a1e7520000000a290b399d579f1c4b274f427c54542c0beb8f7ef4ef124ab360561380a0f94b240000000a1555efbe23805b03aa1913bde4704634f85de4f4e601887beb16dbc995caedaf1b31b35dd1ce6de083f6840e0686db83ebfcd48f0616ad55adfcba74e596b67	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80dfe0bfb135da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB7FFC71-A1A4-11EE-B49B-CE253106968E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000aea3143c7d240b655a6a63e14037ddb3d82efa92e5ad4756a2076796fbbbd33c000000000e8000000002000020000000f62c2f34558c5fa1d5bef0ceb7b1ea72ac19e06806c048be7c50708aed29be799000000049fcad10add60229c30f92aff05e740924c70f37daa5e3b6b815db6250c26ec487eb79d35f889f263feb14742e3e486ebb7a16451680ba8673ada049e119826248895b154261e56f89c58f48e0c73d8362290137f9ed639fef759debcb2ca3d49d7bf91d35e68b10129996a643256a04550718ce3023b38ad22190b929da54142b45f0d77a6c1575925e80ed38f625a84000000007057058e05e2b93a682023df3e5ef0e7e7257ffb4fac76dbc9e6bce3dee6185e2a132ca80614d46cfe501cce5f30ef194bbadd0c1a128508cb62012cec7abcb	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1708	2932	iexplore.exe	14
PID 2932 wrote to memory of 1708	2932	iexplore.exe	14
PID 2932 wrote to memory of 1708	2932	iexplore.exe	14
PID 2932 wrote to memory of 1708	2932	iexplore.exe	14

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1708

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8bb0b91b4f5b22e160a4bc47207ef951.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c27617c359bd578e6ec49ea42c595bbc

SHA1
eb5afa8a5f5d07c2d9b3f82d9a63c8781c7232d0

SHA256
e87ad1b38d4565134c341388af7ee0bdad83eb49efadea73c0595fae87c27bea

SHA512
9d8d138db5711250cf14d8d682a864c3ea857d00546ac17a1b53736c5a9fee1017f4c33f4a94d79d68ddf7b6d645e069d0f1f509801b61197576eb2515da353d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d162ee2ebcaaa8cc72a25bce649b099

SHA1
6f58a4bda542700523c29fd1291f812b7871cd05

SHA256
cf8fa7e0f2113830fdbc8f5247fc05347b6f49327f4856b53a3f0aa61a842d62

SHA512
948f402f68d956c1a2380d33a6d9d8dd95cf2625458d6cc8a56f62e453a39ced43c31269910041c8fc6ae8fa019248dd92c66204df7421ebc71bd05cbd861a61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a543eaa8093dd6c76df15ce71a85cbed

SHA1
94ed3d9b3a4b4c9f131815bb6053e4e3726e282e

SHA256
5b6fa9f7459cdae240bb7cf41d46a4b5d5b92ba366c57a16bcc12a32732860da

SHA512
d6a2ff29aab115154f2dc0f3d613d5531a1c4f1bad02434740bdcfd41c7f8d4e16e04bec3f0cb6c8a36a354ecf6047dc3b41c62fae7251f1f67c3a08f92646ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb463fbf7bb369ef84f6ebe79f0856d3

SHA1
760c0d283af702904b3c62f05f3e67e0e3c7b9a3

SHA256
82c8151cb68b7fb40b11e69b902cd474947a8828edb226e2565ca2564eac8205

SHA512
f1d0b316ce7cd971b274f509bba142be6c73f4207382f9ee68eb8add2ee4797e3605dec50b30d3c97ab560ffcc31a2e81a50a671da33efc2af2569ed19d0234f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e6f019da5256a529fe0eb18a8797919

SHA1
1e60603eeef3df9f5d06f5bb9cc016bae192c3d9

SHA256
0fda20de690c07787b0a82920a6b553bf03bbdf8ecbf752df83d7547fd9a5ce5

SHA512
e50505143bd62362fc63abf9055be8a3f01f4b871cdb0390b6ec047afdf163a9af2d785d129f8721f038a8217376e94e9802a525e3e9de71305de491d3330a7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4009db1a241c48289dbe9a0637ed9623

SHA1
9254b49541f7b3377fc922dac3f9faebc234a474

SHA256
8617b5f3fc6062deff28820ca4eee39be00108b75797205b20f268f388f413de

SHA512
ca6a73ca0a4b0dd2e6f745abc65d585a3843b826b183448bad84806e41e68b16b3b046541e2a4ed1a6649575b3138b61fdccdc2683ec91ea8e19ed7c9c473cf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab26A4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2745.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit