bec88a804942c35c77ca023b624a7e3c6bedbc09384b99e29c62cb1a1406713f

Analysis

max time kernel
135s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ae048c4a13f66a942ba7a22e2d2ae18.html
Size

119KB
MD5

9ae048c4a13f66a942ba7a22e2d2ae18
SHA1

33ec84a8891ef3c1f62e15c012a7ff0888824834
SHA256

bec88a804942c35c77ca023b624a7e3c6bedbc09384b99e29c62cb1a1406713f
SHA512

51f37d84f94aec0482637288e3b2ca00b091e638c911f8de052015fa5f923a8d80e4a6f92301865955908f9d94b64d3c100dfee052b2ca6d8fdb33e69d6df56e
SSDEEP

1536:JT37333ZyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy+:ZbnZyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409415971"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91B27781-A0D3-11EE-ACEA-62DD1C0ECF51} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000000a2848afc0012afaec1c72aa9bbf6e91a890737aa41323aebaca491120366430000000000e800000000200002000000035ef6fa9d35b3306a785d992118aded211d23d51a21fe30402298473af8ffc24200000007ef4043e73673b0b6fc8652e48319e2fd758e206e50e2003b86f27d902457b7e40000000e02c2642b9d868b6813e394125e493e90e138e0c7b0e65bcc7533879ac594a074b282a7201456f2907cabf9f5a983ec0e2bcb5d72883d22056a6f13f2cb059c8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000068274cd758bb8251af65c58733e80fdf15d54ccef56a9c67d5616cbb03abe99000000000e800000000200002000000074d78cc91eacfd66013df921c5a4daa6e21398d480317603b32cb542b855b40b90000000b6caab41486b9a93aa73c6094939710a750b0c18c737769444f65f88df7b794073e1683a040a729eeac9e30d4c0f8f2419c365398c6ed731f29c3d3cfb444f569ad73f7d4bc528dd0ddb48863b3083c79988e248006cbfcc54cfb7255ad1a826f483264769768aac5a8742cde4702072c9e382ccd1d584e2cecfd1571513a2ee3578fb0ed561d097a5fbf19febd49f3c40000000dd1dc5c5d84cd347dd392391635f47a277aae8a96d3fbe70992e65b162d894e13941c3f393eb16c909cbcc61dc39c572f2e73e270c25b0fa8b50b70328976486	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90505c68e034da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1876	iexplore.exe
1876	iexplore.exe
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2672	1876	iexplore.exe	28
PID 1876 wrote to memory of 2672	1876	iexplore.exe	28
PID 1876 wrote to memory of 2672	1876	iexplore.exe	28
PID 1876 wrote to memory of 2672	1876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9ae048c4a13f66a942ba7a22e2d2ae18.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dabf7421c0457a21e0ba598b1cfc2c8

SHA1
3c351532c418689d85699bfaa3affbe6bb226127

SHA256
bb39450efa8ee231eb74347dfcd03ff29eb0ccfa682ca49ebc91a5a0e6598fe4

SHA512
686d21132caa9895a370679c8181d723a2bae40b4318d52cb756bcc4e9b41eda58f71a6a6190eebf3860483db56bfe475048e1e8b615d2240debe7439f54e36f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a533b3df20382a5b7b014b88261ae33c

SHA1
ac464dd09a67cbda8ffe8dabb281ec56da36af24

SHA256
76df35a85ac85c14e5514fd58455e7f0bd41f919090ff3c84ca21a573d143339

SHA512
34ba3784b800d16fdaf92263061eeeb61a6c9a2eb028b2b92d92703a734573cf9f8f55c17d5696644854b885670112238913932ae28bc82043fb0faadd6b3670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73a301cf92081ce5429fc90405beb389

SHA1
923afe7d49fe567f89c1d87a4a438952014a92be

SHA256
710a257ef9f514ff7f0fb96a27b0ae5a2117cc1c3c5ed94e8aaedf661c4ef7e3

SHA512
24ef1b305d65a8bc21ff08e596a4872a6e0cb14a537df5f7e41aa47f3e69d9e6d30df50657c392165853b05873d948c4dd75d695652e8c608c006d04f7ab9d00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfbef3ddecc324d1b5ff8a18fed600f4

SHA1
31c424fcef212ad0e0d7ff048ce444d52a0f12b6

SHA256
313c17a1c8d1c79ed56259ca1db3a4e841e0116b05292cd82e8813807570812f

SHA512
5cc213ff7900703930525fd54ad17da0dd128375305c4df8ca304fdd76863b8d4c1cc125c313d434313d8c7a1b75ac4572bbacbc3097cbc1ebf2a4ccf0956352

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bd750ca0653f0ae439313ae02a75c8c

SHA1
1b0814f6acdc1de6a535d65a69f8cda5676f6533

SHA256
4a742f56adaf3c88e87f549908c732d3684e8923c0ef980aa6f5d7b48fc1aa45

SHA512
f0e7f510a4e0803c3c03b51435eea0bcdf873f471a991778572f458041b0f45fc98a38e99a6ffd535b123b6037f4a9cc89e5c7f43b9ee30e62823e87393841d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a08cf788b7fcc4f6ca70ec57814337f2

SHA1
ceb147ed3d638721bd61598a99f616f3b1d7095b

SHA256
618fce10fbde8cb8cf0001043a201ef7fa3c200e402e706d8a6308ef3c826c3d

SHA512
0b1c739a2368669de77175229db716db03c0658b7633f9a9a6f33a9b583631bdaa6149d516699ce672b101d3b55e0ec7d18258a53a511d1dcacc78f3501989dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4fa4931ae4e300b823799c6a7b27f5d

SHA1
fefb8aa3bce5105c5531b2d4eb66849ffc7eef93

SHA256
34c9b8ef5f6edb6c3680d2466e27120f6923ffc822f5c0860e93daad15081d76

SHA512
34c55a51d6a6fbecbdb5122d252e41591460bd5561615e672f383179268fbdf37123380f7b3396eebe7011b3d4ba288c7373deb0ffb783cbd35901f2d5e89268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07fab6895c002477597446891601b12d

SHA1
f86e32965e5acb0d73579a16828d2e2e375e38f8

SHA256
2d5799057e479aef89d73cdb0c9a28b11c1418bf830b6253a974772037bea795

SHA512
17bae75b21f3ab7ddecd9dfdee7bc0486586c6c5da8810a16539a18800188ec4d22c7dbfe5a01b8005076c82411676eadf4812c73c199e350afb0ea2e7ebbddf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8abf609130ff0f17d4b273078ffe477

SHA1
a72bbb4bac928c984d830fd9c1411345817c47b4

SHA256
670d41c73f43063da528c08d0332e967171bf54d263e62fa7a8850516aa3e5d7

SHA512
a1661ce123ee0e2c76b16052a7cdc7ada077c01562b9ddbee16ec204eb2487f0b2530182459352044f36e04b8293aa457e22fe227c2931a96ea6847a293e0457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7939285b03af61aad4d6d6ef36496cae

SHA1
f1d4e7aaf4b29ee9e35f8e7a905e9b06b0fcf33b

SHA256
1b731674b671efaeb27aa441679fe91bd57519bc4e0ee86cdb942da2916d82d1

SHA512
963149dacb8aae201abb3ce37955f2ffcc293336727d93cdcb098e741cd7c745f41c07547f8287c706cd7c454855394acfb63db5062332ef8f77da605e470d61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e87a7a70f9bdea81c7097eabf15adcf

SHA1
ddc985b71f0b506224bc8590f0d0cab63b1ab9aa

SHA256
6d5dd80b58e2fb096ae23fdca98eb220361a5be7715994acba90b5cf2dfa9bf8

SHA512
7fab9f032ffc96bd651cca12505163f4720131ddd4738fc7c81f45d00d7ffcdcab328614e440c47ac3f2f6a6d49296a60701d6b0a77ba6aea163dc5bdd1a1e2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9d44f0b4998ead7e06110cc16edf7a1

SHA1
87e29e27cf59b1b2f329d65096ecb51930b57fcd

SHA256
1f35d8c671b52ea09217a15623c8d4a28b26d6554ee6319ffeba66d5c69fa0eb

SHA512
698bebb048d169f88770bd497705e455ff7f9e422ce62e00999bf4fc95609089f12b395c0c25472e5b778e2041324f5bd35a326b98d87486b031f1fa8d5fb733

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c338d620233cfe6947ac1de5646766bc

SHA1
e6b0f83c8c91acf11501b351d723a964d450c92d

SHA256
0ea82bfdadb517a25e3148299ebf25ec4949bf3e32bf3e7fc97ac19828e92e08

SHA512
45ee4c8ebdd9d147463e44a03b2924cc766708d2c928b40ce0efb61e73dc4ed00a8a4031181055bcd59be82b6b90aa5bfe29e75f1f1c028bcd76828defa548bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75c7d520a719740dbb406344304226f4

SHA1
86276832ee9a5bfea19f7d1c3020eb17e6db8989

SHA256
5da078b9888fb55f96aa39e7fba163ddce99d40c061817e5a69c78c83fccb488

SHA512
d63e2fd3cefb16041f4de661da539342074909cdb138320e1baf0f0bbe0500b1fb3f42b56a901108dd83a14bb6ef51355bec0560544175b194e8620f45f49840

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9874b9040ca8828721937e348c1d62d7

SHA1
46012845c816ce8b7026502c8a57769538efed0d

SHA256
a32f46f531cec4c6b9f49b5d107360f1addab052325d396de9c53617b24ad6c4

SHA512
17c2a364920f99b1b940a12fbee1971379599de298fcd40f64afd1443c82f4ca29b6add9d7401364ac731411f693510e2017cb4432861cdec66f419b52e9b87c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5DCA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9B9C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit