10bc5817d2e155e340070e07c3bafb3b75c8dfab3f3eb223fe7ea9793ad5ce0e

Analysis

max time kernel
136s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d201ea9bd2800f7a35493c1ebf221466.html
Size

49KB
MD5

d201ea9bd2800f7a35493c1ebf221466
SHA1

a3f6435ffe230a12f7333ec3534a573876f3f01f
SHA256

10bc5817d2e155e340070e07c3bafb3b75c8dfab3f3eb223fe7ea9793ad5ce0e
SHA512

d18195954974893384e1efce8bad014dbbfa15b9047f23a25ca0eac1578a69d13fc6f114c74bde357474651fbdcdf826e2cdaca858c79cf030d7e3668f1d6b9b
SSDEEP

1536:uIRIOITIwIgI8KZgNDhIwIGI5ILJ7SOIRIOITIwIgI9KZgNDJIwIGI5IGJ7Sf19y:519wKFNr+dL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409434759"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000000b270d5fa1573f2a51bef8db46d0f620bb1574de6fe837c227739cd06c8edd20000000000e80000000020000200000000ec86cb12678ff5b57c0ee5c5025dec07b2016b8b9929eca96b69b5a3027da1590000000ea8cdab0d2affdb6e6b7ed96586cacdfbe3169bc114df9950cac3e14d9d1e6cf0bf3340bf77dcfe109413fbe7d8725229406e2efd24c8475897b8ae9bef8a52012ea4f22e8112fae3ed02bdb287e5e40cf4843e3beba2d3eb3eb23699071a008eb7285b608ded36e8233620f83dd37b9bf86241384b7b4d8f4359a3ccc9aea2a24fbc5a365b80ca0e5ea816c9e7b52e5400000003217e1c01341d7aedb44f4176f87159e0f31bd02bad2f557fe709a0926e450dd111f214a3131f5cde136515ae2eb320e978a7adeba5dd029475c134a9a8109d5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000034780fa2560f82f2113c52bcd3ba67a094a6148a3ba62279b88552d0c4e4b9c5000000000e80000000020000200000008eaa5e0e19df275643725029122bb7b10da3c1b8af07c962dfef9e2f8991f569200000008e176acbe7e8d52e497cb85b850ab7455c16dbdc7919931a17594c8cb7177e154000000049e496a298fa5cb55516fbbbf25fa8ae99a1099924a9ef8692ed4198fd3bee2ea50020bf24b6bf9a41109ac6aa6f6bc9fe5513fe2a7e32c62695a9404e42a499	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1085e3280c35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A511321-A0FF-11EE-A57F-CEEF1DCBEAFA} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1464	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1464	iexplore.exe
1464	iexplore.exe
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 2844	1464	iexplore.exe	28
PID 1464 wrote to memory of 2844	1464	iexplore.exe	28
PID 1464 wrote to memory of 2844	1464	iexplore.exe	28
PID 1464 wrote to memory of 2844	1464	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d201ea9bd2800f7a35493c1ebf221466.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1464 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3362873ca0bc5dfde5714f442e4be613

SHA1
5755ad15ecbfa45a206172c406ee6cab7b02e3fa

SHA256
a499e5986588d68bc78b83464d99d091bec3f582b4a494344a13489424da5d43

SHA512
a4352739ba7806199f9ee493f5980b98ad55654f00a41dbc0a04a7658e47bc2260cc7fcdd2c9771d644a45106abfb1be8dd252cc64c5fbe7607500260b81c1bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e8c869da0de13d963d776f25a5a29c7

SHA1
76df774e32a31d368363e38feef7437037c8d160

SHA256
20d66e05ed073a614f61c1df2b3cdac46df2a950e8327ff2653aeab6753dc86b

SHA512
4a5c9dffea3029404ef345439a8d21248b737a2d0317e58a4eaa6e1d1189f312b04166187c26a481ef0b71e1424bfbbe5185ec4f5d523ba85d666050701771f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02bd431918449729375b5ff0c46abb1b

SHA1
d1a3cbf20728bb3c86d344dfec15a7bacf87353d

SHA256
25e7cfbaf5a2002b270ea94b76a0d0de3c344764d04a402d051886916525eba5

SHA512
de43d3b550a3776fcd15219e3a2f7b2388678135f198e66bd4e49c6448791926b0de1c9b6bf1c8818633556187ec4eb9c3888041215d1a87a780212812628d3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fc77c66ba146d6f8d51fe83c0402973

SHA1
00d39fe52d9daafac8fb05c0a4ee294225931d98

SHA256
65af38ee071f621c2e6d06bd8ed6e84940ba279234c28929c8f10870ffdecb29

SHA512
ffcd206a84a5705374b1c25d273427f6bde1a3506e0e4da176536a5b198ea4a7ae6902f45a80146005f006224f21687121dba383fe0e7e9fabcf541680af5971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5484194137ba2edb64d116981ae4d8b2

SHA1
57ee05865a647676e91ddb0c87d43b27f288e0e9

SHA256
b2c21dba5bff6de106c371066764816da8540cf9ec5828d4abdc917412cc138c

SHA512
75d6039b64106154f1cf18017db8313170e286f21379507f297173c0aca7d7d024ce01e266974eac79f0b7045db903d69f51af6ee22654b43e840de157aad8ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf022bdc3609aa6537dd116f71ed85fc

SHA1
ea1ab709147289abf3b92c4f96ec9e94862ab24b

SHA256
76b2cbaac1ed52471fd7461b188aa3fb3edc616647b5606cdd92d4816c132268

SHA512
4340de90787ff924c9a0b4a15d63839c59965d4c97eb586673905e3c1ce9fcb0fbd5cad12c0d9f9c224ff89125a6b4cfe3461be2dfed488ca1a0c34ad88a875a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0c7f566a4f4fb0deec0c6da286faeaf

SHA1
a1a6b85ed413aeec58f0ab580020b237bd8d5212

SHA256
b1130ddbab43eb504ef6a5c1e024d0418d617760268158e4041c47a68bc68ab2

SHA512
2ec05a10881b6c432c55dd0e26817346b4b752efbf97c812606e77542db784d29fee64851526489c95072d9fdef57608352dd48f92abd49d0bc1f7b9165a1419

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28bb885bb2409d2305c953dcec2d97a1

SHA1
a86638c5ed554119d5f94c7e141ca234c7e774ea

SHA256
001ff64b5cc94083e3b02126a6ae8a210c05211574a010434a5fce3d4327860e

SHA512
e83efce9a1eca4dca062df12b404266498cc0b54bf3fabc7dc0b6df21bdfc8584aafa4daf4be29fd0db63ebf5d73e41cb109ba03c5b3deadca9a4dad694f5a49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89814c7f995c7a669289b10486700f5e

SHA1
a7852392654c0be3f19adf9b426dcafd783264a4

SHA256
4fa4aea863f899fdf63670f84f96f2004cdc439e7605d11e8b93ba9d10fb70fa

SHA512
82ebea72dca67f30d4f8afea0ad2b86345d7f2bf63a7856cc2d2644cb68c8bc5e7e2dd9675235820f069e2496637bfd43b256b930d1e41c957364f4861da165d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a6b347473975c64479033d340bff16e

SHA1
afa44ad4508ac36c8068ee90ab575d4b985988e6

SHA256
6ecf6fb4705ba77d154badd7a9998b48ee1ba3e814bc973e7b510f09448443e5

SHA512
2148cc9d2f1a7340b16483055f0a8e36c42d16b1427ee94166a59a6d64308be37f782da8b41a5f6c2aff11943d0d38d180e2d31638af5d5f7b16f87ee584bfce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
681cb7d5786c9d0796ae9fe53701e8ef

SHA1
01b8e9f8dedaae9852d3849cf2ef5fb1f9ec871e

SHA256
dc09603b6d9e46d85a518735906c113dbd40965b6f1b798c88cf9456330e09e2

SHA512
79c11cb861510a0c01f91a3617e233f5cefb30f1b3204f2ac2750ed46f25a2de37d55a6cc0fa8293e08a44d509998e02b2ef296665b27ab998274bc2806df416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7534b6a655e4e6b5f755d980531af18

SHA1
f0fcb93a6d4e50c85627e3b222d11d8811660759

SHA256
565a546f72c4becc9621c880e40cd5b8657824e7147e9f119f9294f83c9e6a62

SHA512
1b703b1eb0872fb5cae63ed2b3976ca488ec8c4be6b40881420cef81a2c20b564185e9ace68a2110a7c5ff3070fa371ffa16a6971992a83cb87bfc6c697d0935

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD6A1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD79E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit