f0510db87419d60ecc21e28a733cc9dfd136b27653265b80463941b7e6366405

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d60461e2b54f935a393dad39e2bf4c79.html
Size

25KB
MD5

d60461e2b54f935a393dad39e2bf4c79
SHA1

be7874e61562e59fba5dc0af47f78867a17a07fa
SHA256

f0510db87419d60ecc21e28a733cc9dfd136b27653265b80463941b7e6366405
SHA512

48ecf084dfd6c7df8673459769bc90f0f0ea4b8fb33ffd4b0f9a98a2debe095d410a10b34ec9db0c33f6b5ac571c3101d48a6e072a64fdaa6a389aa06a6551c3
SSDEEP

384:xy1R1QREDBeCliO3F1jBDphEtCa6XYa645lsgK8IXTRNYuoqICPRrMO77OM0TCtl:xy1R1DeCUOV1jBDphEth6XYaQFV77OqL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000049c20ebb9def970aa2b5076db6eb5250f24317e43cf8a0f504aaffaa29b49edb000000000e8000000002000020000000bde4b87374667b7a22070b43bf084cc26e0237cf87594fcca8996fd91a3b7610900000001daf899fe1bee636a6ceb67f6a1642e5f8fe4a0edc2a3c37c6dea05548c16693bb2a2162d81fdbd457f6d60c02cae62f555fa9d70277419dc9339219aa640c22e3ef82ee05a9f0df8cfac1d8fdee9f0b599ec93a674cfa1091fa17b6d5b456bd866fd1882c6cad39345fab9fc7626bfa243eb70bf41a0daee6c1edd1e442dfd78c260e665b03f14e77571912142e17fd4000000014b587ec647c4c04ecb8aac696b48946ed777c22f4d48e0f10ea9e4e4f892a45c5e1affe3f62920af61a089e486d58b31fac8d35c3808293439ad354dd763553	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000058613e851aa49f4cfb3ee09cb03a31ea852b20d8f4398622b54a770530211f8e000000000e8000000002000020000000cde142d4d3dc296b93703aa5ef8ad81c6c3dfff8b503d99a254a0b54d9a4e0f920000000e4e0c966ff5a34c9ea03819405af42ef94162ae540591b4a1930227f4d069a8740000000eedbfe5aec9ec2153007849c3beaeafb1f13911a1769b92216f52f88b27088b8b15cf2f547bb1830a8a68503c58cb2a9d1538e7069d66e1cd4acd52bc821cb06	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72351CD1-A102-11EE-B218-C2500A176F17} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409436108"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001e9e460f35da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3064	iexplore.exe
3064	iexplore.exe
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2072	3064	iexplore.exe	15
PID 3064 wrote to memory of 2072	3064	iexplore.exe	15
PID 3064 wrote to memory of 2072	3064	iexplore.exe	15
PID 3064 wrote to memory of 2072	3064	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d60461e2b54f935a393dad39e2bf4c79.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd05b0aa1de0c16c3f76d9e12cbed675

SHA1
d18fffcc3040669fe9c7c42a372279567832251b

SHA256
95b4c9e5b1a3bcac0f4997bdb2ae65d84b065545f56ee375bb678392b6c3b0db

SHA512
429e471e4272fb32acaced4d623d16cbd2dcb93b6772b3bc46e5695ce0389ee2930561b00a4b8b76f5a8543bba13ba98d1c5d5954c75f77055044abe9caa2e79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b15b10f9cdc7568bb155c637edcb7a46

SHA1
cd63e082168645cac0cd577bc12b66ee7eb13c06

SHA256
540101201bc65944f9e27fdc5d9bafa25981bcfd348b5395192efc73b1e34cdb

SHA512
afb1c1d950e9e27ed9eb22efb4138e04b34ced0fb1db2d4bb23e01c5635cbc174ccb8157be856762cba711b93702caa0bb5779b0c65bed8f323896433542e356

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf446fb89eae44aa6c35dbc0db435d03

SHA1
203de70514a626713857e7234dbed233083bb51d

SHA256
37b7c2ab2f8b03c92e5127f7cf3f62c48fe08f43ce172ca3a8f77c36ad91c96c

SHA512
b9528e072fb9ffcd59ca8816c8d7dee8e6a9835629354280778dff1661ef458a205c4ec9655e269068b358324bbd14e474ff91a32997fa1d994c3e8ef95a6b8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6b829fb491e4ae061be87cfd868baca

SHA1
1c1ccc3ca6bdff1c67092ca6e731e804c8ff214d

SHA256
3c70efe830193526402c096e828cff4cb8f275478eec80f10cacf8328cb17b0e

SHA512
f5f1fafb72fc1e0ee835c00a1ed46096b41c108c3dbfb1afb1840fdcf880a8b36b36afa4ff3c60a00cc9ef241ce71cb5b8b3d429638340a804b88664bc379a62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d680c3b829a3b9cae1b26634d6cc4406

SHA1
bbc1911599d8f72b1394322004cf9395664b66ec

SHA256
cdf6111cf6493b12eb20a5348959c32c634e99560bb8800a84f4f70d408dbaa2

SHA512
84ca9e1cb42a090e03c171f6b18e64f26d368b5eb5767bc8651cc07264662a02db598989c72fe50da989e0736ca71677545d1ce0575510c593675cf2b069ad41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6a53c54a5231f4ccd64dc8485a68a3e

SHA1
77f8489192b601a2441f4c3e852e2b1d2f1e69ec

SHA256
234fa38991e03c5fe3e5884526ea1cb1a127c3042280038b06f8649db12fe2ab

SHA512
cf6cc06876d3b3d33964d2f66fbf5c2cbc11ef9cac591739ffed0bd8e91c5c2909d873d42d7709927e7cdbea56472402be98a9352c8be0ead778b2e6b664658f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e88da2f2a5d1d8e0d257560c295ab52

SHA1
e92360df8d9861aa27618dcdc55c7b2bdb435d0d

SHA256
f45e00c2d156da28e6f4f2620768492d217c05f83355fc708324bb9dc704df05

SHA512
8b2a536f485a918ab78d1bc2b9bfacdf135e101ca1f74d98046b6db2421b3b513f5f0d75963ebd8a3a2063917cb731787f8f910d2b98808f26ed3c34152e6449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11b7e677cbe7e5cacebbbb49e678659b

SHA1
8745de781c345a0d1e965e8fc5b0c1843c094211

SHA256
1844cd276a9dfa9647eb7f978294bb70b90f4b0a93ed9c4c9e80822bd17e741d

SHA512
3a3c3ead71ecd8ff93eca17b5f92017d697766bbe6c1a33725840cbb6aeb6e79a7242b5948de6e02b79f51de19ead44a3d4f443577c3f90c4bf228fb7fa99eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfc02c8783f1793d412a961647685455

SHA1
8689f75bc7b9ce30cda485b5201e4ced593d46a0

SHA256
0606caf2c67ace34d6f3fe71d67bd3aeabd7c4ad1e8463b61a90a463885f1d9d

SHA512
ce313ad55082182c2e9d3c733827af483eb9b2eddbde5980c67d0b6e587dd7da2831d1bb40883ff9865d578496a1ea3d5fa0d999133ef9a0868f247b6b3c8184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7dc9a5c984ee987ba23094585093e70

SHA1
9371419fdecd96a7bc62ff2d84b486f91af1ad9e

SHA256
2aee21f2f654856e1946beef42aedc9f94468b80fb5f04ab068388fb9325f495

SHA512
1b387fb77fc6471cb808f71759eb5b36b8bf40491e7d33e95b0cd4d697906fc1ff9117602618d2e10cded0573b4d915bc5b9e41feb66d97795042c04fb59d5d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
453b92b08e61bb8a2af7543e32771dfc

SHA1
73eb1b6821fd9e190f11ce091ef31a02fe6cd4c6

SHA256
30dd4d82a18fe369408a335be7896c0bd1e1870865fe7988eba5b24a8cd8e1f2

SHA512
665224ccbac23a0aa34b4725ab0612fca1925571bc0d5abdb84475ddd2bf3a2116050d9ba3519369101ea93253f26a1dd4cae55241c257e77076a0a52c1406c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab238B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2439.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit