cbaefcb870624c782fd1136a0444dc945bec70f49813336223aa2ddba680c9f0

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

158f283bf1ead4dd04ddbe115ff63a42.html
Size

394B
MD5

158f283bf1ead4dd04ddbe115ff63a42
SHA1

ba1e586e209f4a75980457e953189e79a399a97f
SHA256

cbaefcb870624c782fd1136a0444dc945bec70f49813336223aa2ddba680c9f0
SHA512

d2f5ba3eb7be47611eb22cd167450e7f3d1695195e2b71a7be17530d8de9a9c7bc85aa25dafd71f05328ae32bc290ef3df6f68998375f6e5cf7c75b485c89366

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000004dda0f3d9c6e9bab8e0c34ec76aa414b86cf423140caa36fb113a2be270550d0000000000e80000000020000200000006d3e236af70e58c4da34e937a494ba3b6d244c4a7968769dad638e34579e3b4d20000000ce5bb3e14c306d2ff21954c974a0fe31789482002a92fa8cc1276d62a6d8b0fc40000000af7890e40028057316e2795a9208f1a016c253d0590cfc456916ed5298e253fff3bc0bb02211c5a4727046622efa1757fafd99a90fa3567d7f9c0f8f09148ddf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000ff73ad6506ebca423cb5c641c91db3ca4af53038567b5d896a6652fcf74887fc000000000e8000000002000020000000aac0fd565800ce4448de5216843cf21a2713053bd9f7642d9c7d2d16985eb5649000000083033a875c2ddbbba1825a4d3aa8ad7f780f0dfd0208f9cf5f5e7701bb55fd5fe0d1d7a2233ec22dfa0db67881398ff06dac02a9aeab66edbe33aa4e1882aedb1ab14b4dd20bf148c6b3742d0c6deb38b95dd6dcdcc7a4442372ce41ce0696b01fe17011bcebe4c1e62d35fb2973b439c17bbd751b184e88893ed4523d3616ba1ae8327ff227ff8bce4c7c94b9e92e4540000000a3ac384f24538b556e989b29bbbc8dff7a6b34031e5ba84841298ce91dcefb91a3450f577c55c9aee4ac19d941db55ac7883d35c3387eeddd2b307430882ccb5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0fc0306eb36da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409640471"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{408D75A1-A2DE-11EE-B6E5-76D8C56D161B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1252	iexplore.exe
1252	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2740	1252	iexplore.exe	28
PID 1252 wrote to memory of 2740	1252	iexplore.exe	28
PID 1252 wrote to memory of 2740	1252	iexplore.exe	28
PID 1252 wrote to memory of 2740	1252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\158f283bf1ead4dd04ddbe115ff63a42.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d91137092d7cbf6a09311af7c68f27f6

SHA1
f1407b3a1e747bbc1b5d6fbf1c2659e7f785340e

SHA256
89f1a579b0026241b7a2a84097b817e58006f85fd74363ee8f14b318c8e6f980

SHA512
1c97c782662593e28fd1f51358c33bd74ba59ed397a7ec411a2a7327a02023cb735b977fc4d338da27bd7ed2a0f522a6f43aebb387c6789f0275f3e900c28588

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66d0b5d12cea1609a55b096c88ad4a85

SHA1
c6d339c501771803616303a3ffcfe3db97cb9954

SHA256
83748efbf1464295601a66d5d4762ce3c5311b7a689f40906806402c9b42d693

SHA512
e17759f0d876c3c32e26d2af389b0272c8b80f74d4eb52be4b1cb57a471f00c2ef0f6b99b63614d8f7fdc5cc662234ab7d0cb3e8eb432d5945534b2cb247f4c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe085dfd4a01f56de1f2c111e080b5ef

SHA1
98a758150083462fef68bb7808b360b3e2527b7a

SHA256
7a5e73a90f2471554c8d185aca31170ebaeb12d796ea4ca4ade93896e1f5799f

SHA512
5a16b4085537ef3fc480428e9765efd2cfdbd3e693794c79a95755c0569a3641cd806aab1b5185bac634013fecdba9673fa10202b8830fb82cd118eeddb28a9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2dfaca072700bd961c5a859914bbfee

SHA1
a005567b8f82545f5fefe92f29c37b066a0c742e

SHA256
e5de4c724d50e02720e463f26d2c5e8f812ffab482aeda6a6791b8ed511db8cd

SHA512
19a4c4a04946658e28484f8f720e6f3ce08c890a4d4b1b0c1e8ac09894411da059bccc4d78c6656e5812a516b26b78598ac007a67d3bd0d9d9ae8e1871f3cc92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3df3d93cd991c09a1b96763125935b1b

SHA1
d907cb37f199f6fd77e2e2f2a83623d505a3393d

SHA256
3d04af85ca7f54a4b20da6440d1363e300ad553b87e6d07609b207b57c35a783

SHA512
423a0e802a56945b4ba57d729c00be382acf156e49b8a60383a4737a2114027ab6588a404727a99ff045791b064f33c541bac8eb14d3f205d6c9faaad8de9992

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ff76aa41d12983ba6cbec1e14f5c5b7

SHA1
0edda7cae73d8ba0455736aadf2fcf4094a4b7fc

SHA256
0d1baad66d3b903cbea1ee47764b3eddee8070b90f0a3a22fae048d6c6cb04a6

SHA512
59d05791329015ee25392018bc091d4dc17701b5d7bc750339135094b97852a9064e85a64aad8b20d1ecd8b6b926d380a18525f71947c2322174a1758bcfb9f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34e83fb52996321a64ecc26313633b16

SHA1
f47fbca451b0f350b7501449d36bafabd00305f3

SHA256
45a46c2be0b94877028be5e3a09ed46d6a8dc21957a599f078680dec2f060d3c

SHA512
f80f8133c21cb9a8e4c379bfe48e532c41be28e91dca088a9ad020a1f667f43c37becf1522b15184e809ba7f5efe6757b53d79907b2f3422b780e02f970cc532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
709d8c3519de6e880e2fa76d163d8187

SHA1
aee855214a12b8171ca3ea2a83de455e28a928ba

SHA256
bb18b4a8dfca877807dbea152333124a3e4fa71e4fe0e0959d2dfab80ebd2da2

SHA512
13b1ee55a12b6f3f05f0e624602e2860ca2d9a28b4d761444cc7b9abc73f3ed8cd190f904983a7f9c59227b590dd96cdeb12a84cf21e8a33f3181048b12529a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ed961efee6fae2506af366e899802c0

SHA1
188fef040670032ddd1b6d9dbe58d92e9cf2e0e1

SHA256
662f1a179f4e32ee8f56adbd960b29731de083bf954c78fa3452c59010295f0b

SHA512
949bae5ecfeec35bc780470c7c5375db805e5801a0226bf885b4132e9baeeae4fb4e41861034333173d7901fb00b1aa3ceb7b229b1101fbe0b0267b2749123aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1387c7c724d50d3060a82601d2f7e461

SHA1
07c932ba50fd8a41b879f00e5688ae40a17a63d0

SHA256
1ffba11170fab89be015201e4594b3f25d956ace2ab73ad0b53a409683373f99

SHA512
04715de664036e9f8802a0c19b8056bab16fc604950144558e1d32fe210db6e31a9d10c02da2c06e34f0ce3d74133ebfab71c624fad51f3b7d26e57c8c00053e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c277f13719739f408aeec474a5b1663

SHA1
349653dbb76cbca7305eb9b4ef7316060731d1d3

SHA256
9ca5e1ad54a91b7b6e08a18760c282a14e0e033d077cbb94fce5494526fcc4ef

SHA512
1e5ecdfc516c681ae3e28ae2cd1f00bb7c47be439cbbeec51b8aa1e30a7e396719df45e92cb7d03b340a4478045a624ff217cd62beb186bff32dc4e91a9a6c95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5718.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar57A8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit