8b8a5495e8994ce28d8a83f84b03e674c62fab25466e08d0fd8ee58b5f140f71

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8621cea239473fbe6656674dc2a0b55.html
Size

1KB
MD5

f8621cea239473fbe6656674dc2a0b55
SHA1

75441ed7cd91f4b3af03b0159bbfcebfe4cf953a
SHA256

8b8a5495e8994ce28d8a83f84b03e674c62fab25466e08d0fd8ee58b5f140f71
SHA512

8562451b322d04383b832ac6f49ecfadbb98cbe4628a2fdf468436a6d737c3470f1149dcab3e5ce3a149dd48e624edf52e3582eeedb5173a9ce88e778b3211c5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F72D2FD1-A11C-11EE-8E99-56B3956C75C7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000027365ecc2cfd7ec8c08a64f6dcf48262b97fb6c4d1a401af93310b219d3235c8000000000e800000000200002000000023919a7592f1b70757a215d870aa571079d233c37ca783b41e58731bada31ec4200000005a800596318fb6cb5824d4c661151a4636f1754cb1493e2f29e412613774d48040000000129cd3e03d4bbc4fb36bd8e7fa7a9295ac67ee00215b6c7549421e22db9715dfc1cb575cbc4da702379c56f98be1952e755b824b8aaf264a94f85d019ebadc4c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b18e563b1517051a2d59736cc999d48e8a68f96e0f6f9732dfdce6ab975b2e02000000000e8000000002000020000000971ce826c27911ee3cd0531eb21cae7f07843f8d712b78a415b419f3c29a427b9000000087d908854676ee9199ab4b386e730a92ced05fa804229c6a3f55c75227ac117884347a1bde842e6c71a0d945615cf497fc1d5f803bb8ecaa2863ccc6c2ff9fdb50759ae5ec30be0fbfd69bdfdbdc1babf7706bba0a7bfa3803dfa8f4a3877bef5bf33e0de8041523d38d57fc2148b1102e908a693af81f9e7d00833d1594009a15db334a11c2fc36eb3861269e563f2e4000000045a3151cb4668d9f6ac88510ce30b68e55b85f4ce609e30c46e73a8db789fd146cee6a72d9760f98ab96873dd042727a5c05559e7d186bae04aba493f5b185bc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60215bc02935da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409447504"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2996	iexplore.exe
2996	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2168	2996	iexplore.exe	28
PID 2996 wrote to memory of 2168	2996	iexplore.exe	28
PID 2996 wrote to memory of 2168	2996	iexplore.exe	28
PID 2996 wrote to memory of 2168	2996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f8621cea239473fbe6656674dc2a0b55.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73dc5d4da8ccb06d215810386398c53d

SHA1
b3c4841219625e0749bf4f0b172268db2d1827d1

SHA256
b76f594255d0162db3ec1bde27199c8f3a61adfd3a8e949b006b9d62ce1129f9

SHA512
0eebc07d4e07f0e9772360281ddac2c2bfd77328295436e69d5a391aa2e9ab46f7916c1cc409161e08d44fe9d92c855d2767f542fd09cb239379047c48e1eb33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a20c32ce723ae1def099c69d04722339

SHA1
a0439b53ec1998fd0022dfa3510dd6d8add69193

SHA256
adb571b46bbfa679d946d2f2b46c210c9876683c2edf7bb9f83c74b941b414e9

SHA512
c637bc48422b81d14c16b062645e618dbcf632b5a33d226449a26115a9ea6f949c3f72e91a80a17ded6bea42751c93b8dfa3cd67d2458b70cbe7dc9f813bbd1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37a7abc95ad56033faf9865a6b730174

SHA1
4f38437c2eb0ef499c0d283483d8e4844d215bda

SHA256
a666a6fa2224ce9d9c239a052478a5ab77fe65ffc7520257f6b65e305d9aeb54

SHA512
114163f039fdb4eb788a14e3cb4bcf0491f0e4b01366d1a78842e1c6166b036bb1b21d7cb92bbaaa5fbd632073e4d10e10e72e70d22f0cb02afd91a4f1d43d4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61c1de879613371f32111bfe47f5086d

SHA1
8f5aef30ad595122d0e9eedbc746f677e1f525fa

SHA256
e6d78508a1b231cbcbe6bb0426543c57cc9333ee676c870c203e3f6b5fbad868

SHA512
518aafde0c9002a54e53e339fe792fdb742e5f71b6849da455f245d33e76f8bb9dcdd2f814943c1204f5976b2f6f2db683eb411850287af8edc65c2a77dc718f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09ec66d4130a81abe22c1afa0a879dae

SHA1
8ab8bca9b075857450fc13a1f8cc85afa0587649

SHA256
d85a5d20692aba3b138b3439261e818e5038731f8835a51df2a5d1a9aa6c79a2

SHA512
596c54f5de6779f701e1819874a1e55c2c90508d98cdd0696c2b06277ec933bd7ee78c0a95ae6c52d9b3c1559268ab2d265f315a5be0697155251dea9cca492c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6e93d29bb79158f48fa1d22459f07dd

SHA1
b9fbcf7a91adad346410852622d16ea509c8b37c

SHA256
6d5ae5cbf585d803cfccddd197508df0ceea000ed86a31d132a5be2c14012ff9

SHA512
9e285074cbbeb5a51fdb2ed8608ca3399a6bc3f85ac5e2772e10e3b89909f8906de44e2c6298fff0c0f72b3d1e5a9815936951de4968384284d75f637cebea42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40a7a38cced7b6b4a25be24bd2cc501b

SHA1
2aaa3f5b693105eac80a421343e4f54a96b8d4b2

SHA256
ffd8834f3c4ea891a34ccbf4f67ec6067d9c003f5b715fc804f65af9b3197274

SHA512
4d2892279d31767e70d31c66cc3014e2a7c7697f16986f9a3700d0504d1ab0787051eab88bcf6b684ab0c976efd21917e0aed109f0ca59f9fbdee0098daa56f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50aa16b5036007984b365fc72b9fe28e

SHA1
58ec0d716e5a37dd17fbdc813e129886af4494c9

SHA256
c2762d5e998de1fd2201d69ce03ff9765059d16f4e165d04bfa158cc981de3ce

SHA512
99269a09c0f98b2648cda1a1cb4115c9de1383fd64764b197f8d44afb02fca63d402de8569c906a2e2984fa912265e47f49da157e2454e5f8d61dd82164f2721

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eb9a3b89e91effebe305ff2429a8462

SHA1
20c1478087e2e4b5896c070726a672ff59455f09

SHA256
f3d3e50028841c3bd25bd15857f843122b7148beabbf247db5525fb87ec48561

SHA512
3ca10a4328bf6110f8faa4ec7ef6a2d81d3d6d35ded5669b8faf08cfdf02cba8158dc4fd5b75d8bd129e2d26687bcb989909a2969304026d143e86845fc089f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51ccb82b778234ea72fd8694f8e9f872

SHA1
d8eb34f5627b591867b7c85e0ae35bd42c781aa0

SHA256
f72158da800ba66272b5e445d1102646a41e5015f65659bc85dc2743019bb654

SHA512
3952b77753d14fc6c52fc678efe1e52feb58b09f70c8c99fe45caede124fd1f9fb59157094d2ea054a5e9dc9a52887e76109f4d8ff560a7f33f1dc255c97120f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2974.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DCA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit