30cc2c7468a9f3a9f9ec532f5406393b41093c7077ffb4c249f809cde663beab

Analysis

max time kernel
121s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8208e1a97ab721345754eb6f5463112.html
Size

14KB
MD5

a8208e1a97ab721345754eb6f5463112
SHA1

56630a67326057bccb5171d0ec3407ec66d1f274
SHA256

30cc2c7468a9f3a9f9ec532f5406393b41093c7077ffb4c249f809cde663beab
SHA512

668d4a3c5f4873f99b399f3fbd8722bc959906c2129c395f21d848a837b4f25561c150b538b8a3e7cb0c8916670e0bf672c7bc709e7953c5685ff4531f096c34
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1vumlKt6DvE:aioWD/ZmXg8SZQvmlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000003c57790ce9fd4c2ce7913f8eb41c47560ac654c5895c3e23716cea0b6a05ed5f000000000e80000000020000200000006fc9e1112d5a9630267057bf56121336952bdbca91b41791211bd0b23aab3e9220000000e34726decf3f398f399564407addd14ad10611b5b05d887a525e6b0ef2e51431400000009d3c76d0e611f900371eaaf74a3f7e3e13200031b51d47469bd4f100d33523cbed8176e7cf60a4c15c73526cdee45cbe66cc38c6a901a0ba6996067addf850ce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{479A0F51-A1C8-11EE-A835-76B33C18F4CF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0873821d535da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000bb414de1d92b1097a95297037e2c3861d6e23afce8a6ae9d878f40a812f80e47000000000e80000000020000200000007883480c78f057fe0e136ed01f39adacc1e82d156184e2d1178b9ba729de7f21900000004b4893f9c710fdaced4fdde8c71e9aa4ae7fa5d25e334ef434c414d2ebc637a4b5ea6f0a74325cbf9930e57bf40a72b47bd04a4e6bc9f0106586dab836a48c7ccada5bd3d3c74c46e3638a28eb289c3b881b09ce26ac84b7759e8be51934c8446a71bc8b5526b135571a52af76a863cad25b276a31204d1a30abd1d5801cf04b0b98063566e66fb3a5f29c1c1d53a1fd400000003479dcdc7aecb91bd8568385f91a94af29bd7ec7f5150de7df0ba65c7c681bb9ae871937d42f3908849fda71a7e3e83b2b5c30ab1870d3990c2141509e59a2d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409521080"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2476	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2476	iexplore.exe
2476	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2692	2476	iexplore.exe	28
PID 2476 wrote to memory of 2692	2476	iexplore.exe	28
PID 2476 wrote to memory of 2692	2476	iexplore.exe	28
PID 2476 wrote to memory of 2692	2476	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a8208e1a97ab721345754eb6f5463112.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beec68b1e925204280313ad6d14a185c

SHA1
b59cae86ef2f45628b7fad2081b3aaf1a517aa61

SHA256
616923157acd7c8ee41435d5f584ff757c9d34bb7143f620ed41c6d0f10466e8

SHA512
bcc2cb48d4442a49a7c4976fd043d5f3cbab99e4ea279e1398e43577448fd316688b7f320c15d27cfeba795b542d7c812045a9bcb081e1e6884bda312153b10c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bc0fd2ce99e9a241df705230a6a421a

SHA1
75a3b0006eaad1ee6bb456ffbcfe3789d3ddf5a1

SHA256
5c8e616dea62525417d5304e2980920e080a189b886fb2df6535264828e87126

SHA512
9f5c924bfbfe5d353ac985059e4188a1d231fe4910017b6dd5ffbb545bc9807f2f90a45a6bf5cde606031a982a0d20a051eca58be75625e6052583bef9c698cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44074091ccea040451cb65592c0bc9e7

SHA1
d8bb3ba4036704726f649286b4482d3cb7299677

SHA256
a061146b13659975028c12dad0306dda9ac430a09e07c398a67888fff648ce9e

SHA512
9cb9bb762b25b67ea898396da59e07544d95e49608b766b1a32317de131de72d8769c0213164d7935fcff85fa67b33471514abfb7754cd5ad0f9e55948f58ded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f385eef4d24e10f7fd6a396021adb766

SHA1
60339f5af5c6136add2160cdb88e596c41ffff62

SHA256
53d2902fe2c67e6734339cf61a70f69ccf7495d363b81328218b2faad2620282

SHA512
d79cb3b630d6b51dcb0d96410f9ce650e48fd32171ffffdcbc4411c4d8aac31284631148c8171ef84bbc8c84932167ce4d885bda3149e86c741283651a017cca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7ba96627382dd93afdeb5c119ff9d6a

SHA1
9695f43fb8ff1c2253aa3a8aee82cb0eb5ef010b

SHA256
d68f4a05fe28cc2c227b991d6a585b618504497f519c9cfaed74baa814427212

SHA512
a9cd99d9204e6836bf0505c6c9da49c4e45b83b3966c56e9fc84e12846f5c16b1bb8634ea51becb2c8e6471b99f7be398ca984102c5e91c0f94d8e46b5e67029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bd8ab9867e6065b3f0ecb395336facd

SHA1
15540d43a7c8f296e3f0a17f2d34e77ed6785db0

SHA256
da1562c3f444a817fb3bc28f0280f88b537e9fcfd3f49f0076d9680fea370306

SHA512
48a6abb0be34da0e14b56500a83184a48b87a92b60e69eacd63b755c2ed6ca925c5d2080340eaab322407cbbf5a98e8583434fa7331bb7b55d5c457fe1fdbe1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a3b2ce9b8c75c06418d379cfeaad7ef

SHA1
de403c3a94e06f8f1fb6902214393dc5096d1130

SHA256
99226988a358018b7e4cc1bc6db39cd04549d1a9cc0c675da2444f08221cd3dc

SHA512
fb7f695d11f5caf40c176ada0da73f7cbe7438f41b8dfbfb9537cf5704b4d0beb58c37c568441ccfdc1224e6ff514c32ccbbad76fb3dd6289caa50437db29806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b7634ad43e53d709c3848431f4067c5

SHA1
c2be807e4687710d1c08425c760825e0e570e883

SHA256
c1d38f63ba8bedc8b5bb9521f46467f198da4a8b90c4cf4844d96ae9a2a2fa9a

SHA512
24ac49b21e326bfa91ef98a7fcae399cf94ecbcad8f4b2029f8bf1ce36dcd6ab676c409479ce448ed67aa1576b80bcd87d98fd10f895bea3bf5d2104a7e81238

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD413.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD501.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit