b860e5cd18f7458126485b4c05f5ebbd40aafd229ed9d0005d08b6d573926bb9

Analysis

max time kernel
136s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ba62d41d74be3006ca9fc94544ff12e3.html
Size

14KB
MD5

ba62d41d74be3006ca9fc94544ff12e3
SHA1

7da5ab500893a92b12d714dcc52487c955418e08
SHA256

b860e5cd18f7458126485b4c05f5ebbd40aafd229ed9d0005d08b6d573926bb9
SHA512

94f71f290d7d88642f0e982cd284cdeb35793521dc2cf5e33b0985ab84b7a8f23c814f0d4b37e23d94d024f3ed9be929ffc4bfff4a80c3241fdf7cee7c355693
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1v0mlKt6DvE:aioWD/ZmXg8SZQJmlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409426801"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000045c5c54b680077077af27da7852178a2135024ad6f1bbee1ea7375fa57074576000000000e800000000200002000000028e55ee86eb59ea610015fde7e5a41e7fd5e7385cceecd63e616a637a6eb44d620000000cd161d8c50443c9859d595183cd053df8a38c40994258e87d55854f5c4736ab540000000f06b4ae6f671922057ea838154207e42d8be4785cdb705c44c42ac96adae992a793a2d6b3a990d7b3ed6e9c5c76ac3909512eabb23ec973e76f03a42d9ddd980	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7D1E621-A0EC-11EE-AD90-6A1079A24C90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e963bf420facfb58c67c3314ac7618052a8cc761ac14a237f9119964f8297518000000000e80000000020000200000007d47676b2121ce70b819eecf077ca26f86e87a2c8d52c2c4ecf82a23dea7544990000000d297e7c779ab652bd22418343d491daa33a7828a7d7c618e1e51bb2153f3ef509aa15fbcdd64a28ad772a430217e6819672dc43e1146ba953573808a313c841649dd8f963c06f46cd6cf1fd08d4cbf3369fb3ab22847a789d2e68f9421094d75754d6b4516d27d4b709b2650cee433e4b0691baee2d8940b3e5763074ff531f0ec0c8b7fcf89597caa6b226e27d369bb40000000e011ca6fac3b9efaf14e0fdb4307bd5a49db2633dee82831799987e8df84c715360c7e5cea394dbaf233355c8a45389f0d6fa9b7f8ec07590f54bac3b38009dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0090229df934da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
812	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
812	iexplore.exe
812	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2456	812	iexplore.exe	28
PID 812 wrote to memory of 2456	812	iexplore.exe	28
PID 812 wrote to memory of 2456	812	iexplore.exe	28
PID 812 wrote to memory of 2456	812	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ba62d41d74be3006ca9fc94544ff12e3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:812
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:812 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12774bcdcbe0175fdcacd5ad9ea79114

SHA1
1c1d9663e5c7ad0e9e467ced4898f198e919911d

SHA256
944eaeb71bb86f4f3d37434d64b2ccd1e140a4117bfd02ce8f931ee9085f1145

SHA512
2a386773cad4dffa75d09e40d800fd0ddf7db4a4fb5cfa5260113f07334b5c830268858dec85a4bc253da37516cd32f64429ab712b81cdac1ba847f12d0acaac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a56ab9d3a707b9309c19a7ef3aab029

SHA1
6a06f6938ecc837999786c8885959a3d955c06f2

SHA256
ede8497e75fc995ff8dbe8121131657d3774a43c2617b335cdfb6297a39b0edc

SHA512
9d65bcd784adc1a27a44d3cfe83c7c2ced8774536f0262bd6fe096e00504cae5b9bdede1c52a312803eb8dec5d40dbc080bdd3fecce101424cd338253e9b5b14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d910f3f33ae85e52168514210663a65

SHA1
12bec2720aaf5cfd8e20d33f06871950ae33c2f2

SHA256
61f88b8fe83b3497db55b7488b56d3a5d22c4c3db232d39a99decf4996a100ee

SHA512
b5d591889153cb978b4a8e873538ffec977073ad6dec52d78ebeb934f0391eaa01571ff5bd4ebf1b2c4c5cdfcebe5ff970b681c984e3b4d84000910bb8ba4311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e7b6a606a8db99f5db4f95d3fbff351

SHA1
29688fe856749e98434e0c597a27a73bb27f2b05

SHA256
10540268aed0795f412a50962d5c01c152dafebb6e30d74cef1872fb2c64e026

SHA512
ca61ef59d03e24365e4c0ddd82d07c0a4313d5f14d0d1c85ad27eb77d1ec460eb6b7c84a932c589e0f0284b0e9693e57ba97ba1912ace6d048d349516b650072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a86c329b5e1a3c66b362b95644e46e79

SHA1
543afce62eb96a3c0a37d89466a8c4e062668880

SHA256
f943048160a31331584004b99dc5b51670f7218f9d549e22ecd334e3e4695674

SHA512
3fed1173e35c5e644db23532dc68083f53b0c07db95050f52767b3fce4707ea270085d6a593decfb431e0f1609675ef2d6dcf3fce522997a5cb0e023d7758737

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53d7e228e5d8deda2ef34fe6e3ef93c6

SHA1
62d01fe7c7ddc96b3bc709e062e0c857ced35ddc

SHA256
cc449926a27a78fdfce7a0b256ccc02e0a10aa01ad9c9510ccabbf873bdcf481

SHA512
696a3a7191f09b9e246a29b97e55cbd55255f036be214b85ada2ae0e7bfaba4a224eacd9d6c6de029e66c831e501e0c04656abaf15df311789f7133af06c3cc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2a4c6f666b87b3a4a93f2a8dc8cc3a6

SHA1
ac8885ea58350786cb29363e854cdd641807d81d

SHA256
5ffe795f7a61bdbdd118454318c469ac567055b998ceb0d8bf886479a2af9eb8

SHA512
dca9f0ed6936c433326f0c12b0e8da902841b52067f3e75cd0d85d6a9794af696150fe1960b2b02ae6e5afba6d429a981a7eaae14aef63319e50f167f8f9e6b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8363b1f16bd35368ae7fc4bdc1bd72b7

SHA1
1c82f8b7412c024d313d9fe4f97d203f185cb494

SHA256
d5ee2371c1804a9d8a503d57bc926399f566fcadb89b3dab4ca1ec431ee7e818

SHA512
9083c5c5c2f9449f9d14e5b05869fe202062b3ddac7786e43c23ded38a12f1908b16157c0426ca0f8c69f731cb2ae644398f6000c27598efbf33187496ad8f2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a84cf668bdfe0d43a9560d02db979fd0

SHA1
d76471d57fd1983456b764717a840eca96ba2c8b

SHA256
b2c06a6c0813f9de2c42a24d6f2b261dc63ad7bb2ae1477f57466395a0d3a698

SHA512
2cca40f3c7a932ba62d242ec283b0ce6d4fc9f2e8a23eecb478d517ca335ba1a344b03f29e1148de18ffd0cc3284f765508eddfb16a5b39edc0b6074a5f73a3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bd3e4977f6cba7f85ea2103e0301ec6

SHA1
8f6de866cdbfcf8876cd1f93e0b329f52ba4e074

SHA256
6fa9f0714785078cd6aa3e8adc41794bcfb1c4098d51aadfea0ef35036d275ff

SHA512
2d54f27fc0cf548264c248e33146ad03d65613c51805dba523018efe7f5f0d38d74b9fe3948922e59c2942909353d9bd69314266c02b812b51b59a89a51a3a1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d9ee35948b394d0df9507b843e950d7

SHA1
d50b6b4190bed80b9fbe7f6ac2f8e2a172ec2a87

SHA256
acec6098f0e1598dfc9ed6a17951a7c86432ea3fc45d986e3f64d481625192a0

SHA512
0f48b03483ce3f00f07e611997a032d9bb0bb05d903abc23d30b80638740aedafa541f1b27fd9512f5390242bee2913838565faa55f3a84d06013c72c290b33a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb58f3d97ebbfb2725be0f792d53b71d

SHA1
2509cd9bdcda8e647c22d9682305097cc24f9b88

SHA256
25dcc5701be45bf4e061c3ade30a781d34c0b806aa75c4f3a88a794a532f09ea

SHA512
a5cfaf3ae29a525ca579f9976f1baa1439da072340cd33969db8f6d12365b77727ae9b6b221674ac410d4f61963c089f20beed7d8d9b9a9504c37cb19afa9fd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b120896d427cf1b1038f99ccb1c05c4

SHA1
ab952360b6cac02f0614e1196f4939c565457db6

SHA256
a2cdf482166d38efd469389f03c01f96db19a46a90b209650c795b7c3312cdb6

SHA512
c8aeb01f06889120bae0b87f8f7c0beccca666b59c7e11037119a317c09db53009377b8cc70dbdac064049cd679a94bec7696a1a8488cfa279f44dd993f2abb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4327b09d5bdd5600cb5bb7933ee1bfc7

SHA1
96bc83e0f3521050ee3c63afb5b51a0997aa7840

SHA256
3f941ab61548db1a992f06dd31c37bb297dd7d8db84cfe8979a295b5e81babfa

SHA512
1a485065e901d58413f0954faf59ca8de4109ff354369f8114cd773013fb9cf9fc8d39f6fbf4b5288002deaebf5a8e492a82ad282c7bbf81e9bebac11228f991

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af8ee736e5480190f8adef8828ef5054

SHA1
7c90b86e2a92c78c86fef79bd082580a858287a2

SHA256
7e3ca8d8b5244c4c746a3bdc3f77e2ae143994c77c4c52d14b29ad2b6b7ba75d

SHA512
7dfb98c9f0d0c0e5506ad2f146faefa44d468471687dee6792d28e357ebb8ac72975f0aeb06b01f2eb8e9dee1008783463a21deabae64082c0cd46863b3d4c3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
136916ea416e29959db859d08e1c241c

SHA1
6d16f04ddf3bea2efb1de06f39682429ab89251f

SHA256
8e6a64f43127c4914e0c4e261ad661b47b3f6cc64867e5c376671fe2ffdf5557

SHA512
78ab5bd48fb972312ab9396b74ab80159d8e79f5d6d27fa8dd8a47b27a5576c7492afcfc985f04028615681e845b2203be35719468fe38674ef6b84fd8d4af81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9d3cf61d093b5fa18690a07d0bb2f63

SHA1
6a77e2c0dd74ac5be96d96c15732ffafd956c5a2

SHA256
d32cacb002985d1a099f8876e0b9478426fd0e0a4c9c89fa629508161bd890e9

SHA512
6f72be482bdb5af93ac2bdaaecc51f68c122e9859355b57fd42882f7e26516161d48dcc2d50ba86f9f2b739be38065db8d6845f7e4c5e52ebd65d515a24559e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA6BE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA7AD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit