6c045a95a6f58bae0a0a740b41da1034fe7ab69c6960f194ebe190d6084770ca

Analysis

max time kernel
119s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0172c1cb9da3a6bd02da74eaa9192b6b.html
Size

18KB
MD5

0172c1cb9da3a6bd02da74eaa9192b6b
SHA1

9cdd8ea23f26e33fa497396a21f49e9db0e24174
SHA256

6c045a95a6f58bae0a0a740b41da1034fe7ab69c6960f194ebe190d6084770ca
SHA512

78893d9b0f9718a084653d2e2f7884a658ef4c3f53f22a93bf8d9f2e8cd86fc43a9911d8a1de71a32e1b5b58b5a49a0d27f3469e948d6d4fd6ef3a615b83ecd5
SSDEEP

384:xAqWb/lFsbahr1AgdGgs8jMaztTLPAuz68MMv07e:Sqa4bK1AgdGgs8jJO8ts7e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000690e8111912ad0a9f73a19b09ffe0f4c536da9d472c9b77f1327828ee1b15e02000000000e8000000002000020000000c384611871e0f2f10b746ef6a01af9609c229d9189146e39be97d83788c4a7bc900000002dabd9d3518c07eb9999b32062a8da252b2cd27261ffc544cc9ae4a3890993734cbdea778d5c69b7fdf2500269bef09af981ca998031c39138caea97ab15f05410a7eb8be0e5b066e0a196f997656ff2aedb71d1c460b9e7ffc910456dbc038220083d0838b83f997226cd5bd3cd07589aaa54e9225acea4df3d6e951a61bee43af5a6827f97bd94097ae829688181f54000000078f8941e65d07676ddbc5c08ff18dd5d2494e364310330472b250f80a33894e71d549e1f3f17f4c928ca3ab7fbcfb552bb014cf0847893ee3d2fef336f742201	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c07045f88d36da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409600454"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{169CF4D1-A281-11EE-91A2-464D43A133DD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000027bcc4031c73a852ed020fa77a108df193c624ce82ad2889e09c2cac12dadad7000000000e8000000002000020000000aced5054c14877a02ff16135b80f29af7369eacb1f3e3143cbcaab88507bcb4a2000000050e62956944775580e8bba799e919ff769a26fc63093102bab9804d70d9a7a8040000000f8baad06603c7c6224adde945352523afe9167c14c21f3d33839c690ba60efd167abd0cc1c3dd72aafa6df492a0d65b3c9968abeb860fb5624efe96cdd93f255	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2524	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2524	iexplore.exe
2524	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1724	2524	iexplore.exe	28
PID 2524 wrote to memory of 1724	2524	iexplore.exe	28
PID 2524 wrote to memory of 1724	2524	iexplore.exe	28
PID 2524 wrote to memory of 1724	2524	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0172c1cb9da3a6bd02da74eaa9192b6b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6dba8269a1f9bc51a5e857ad3f03a90

SHA1
f862c9de50fb5e19a1df658a3e8954b8ad81565a

SHA256
11e65f27e8ff3043b4ac99df9cd7deb3c4fac2a3e0caf803989a6d2fc12df038

SHA512
69306f950493da14d3f013265a46c3a4b0f99bbac194f4d71d3371587865ec4dd9e7cfc895b0897b083bb279b6982c133f4413b88ac2075703a5ff124167e03b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c506bfc436c65b7f0d204af1ba3b0f4

SHA1
bd8dbde6373e40163029428449b07a8fb49e50bc

SHA256
b3c448423bb6c847a8fcd83fc518f0c4543af718b45157b7bab61a1cfbe9daae

SHA512
cba5dbf3ff23b834880d6cf0ee499363c3e775ac3dfed6917a5e4813e8046eb6540657e8da25b446ba6522e2af5f7930bb551e048e48074f858e367ba72e8413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76fc34dcfb0479aa4ea9bb8d4ec36e70

SHA1
16543d0c566a1dd197dcd3ae608c37da0073a6e4

SHA256
e704c33937897d39de18495919cd10a50a37462b9c032488c21070a4a904f096

SHA512
4e7edd99eb9a2f1eff34114258e7a61980b7c5d0541916577a9cfe24f370aa49d27f5c4358513eb62a927ee7310829a8b6ca6f7b7e3ecac61b595776831972d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
528c62b3679b51bc47696ae7aec570b3

SHA1
a14670b1047ba93ed700c582cc60ec02dbd81d9a

SHA256
e0c7dd5ab957ea221d095afcaae2f904e248a9e12b82862a28c7d2c3765899d2

SHA512
bbafa8d79b06c3aae506cbc2318ff03e1425aff1f993ee2cb620b0b2865c2d082876fa10949dc3b0178d1569752f771d21365a640b2b10857f293d62da4b9ed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
471f4eed6d51109793b2f6372a42d724

SHA1
2aa8dad4edcfa0220073d810727bff499dd85a24

SHA256
42b0d2aa146babacc51373bca8344f7f8e3cf4381cfb4e3e87729b61fb2bea6b

SHA512
a1617804d23e9bf628afb834934309046ce50888fee3cc34b6cdc3ecfa3f1b0aab7f4b9a16ff62d2db1e48c2539d01d882c26f330c2a1a0c9252c1b072bbc825

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9411e97fbcf49218d850c8fcf83c9d9

SHA1
a3b195f23cf698f8fbc3b55b86227fd4c1d8c365

SHA256
db3f8a7a1f05c5144b4f27e2803198a0382a13bf33cd6a2e72ec4910d65f1594

SHA512
d3b9d4078ee0fea86316c7633cf4f7571834d1a7cb5716e9c5b94e6a9bf26b4e9f97b7a0d803dbfac8b0c0c021438dac2a29a2d2f5c506d8a69e06f824be0f72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e503420e8a4d2b95fae29f2af10942e

SHA1
99674f9f5ddbbd69ec82c28a5e19a7331261e332

SHA256
3f0e8cb1e5ac15baaf594bd261cd06a48d210533271da2da5215464ee0b473fd

SHA512
4a1103f461a828116c38e460de4234ecdcd89cae928b742d1af4451c1e7dfb392c59ef55acafa3e0a984b401700f0bdc6fa8a714c64d86c957ae2970473bc814

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b391e2907388cdd3c5237e0c9165dd6f

SHA1
eb18e5125616ad2d1ba6437783cf860ba05a5305

SHA256
fe749ea676a4b5a63276705a63103be9fda1fb61f5ac944f54fcdb7595c37712

SHA512
21c25cc4bee2a7cf93ae77189e59d164ab5d8597a6d9e6e57c2cf0a210d21764d759ecddc4d60eceab020582f8fc0d743ad265ad3ab02251484bcb6dee341d00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16dbe696e85b03a9b34b18f8791b6a47

SHA1
2401482b48b8dcba7e30b35b4e41deca7c36559a

SHA256
10753d4fad12baf0b2e731eea6ef7163d6919c1b877f6dabc432ca2d99a32e62

SHA512
d0b1d9bb7e3df3466218880cecc8b95c8bcfbc4ca10c8b35f2cbf3889413b3c23336f506919acc9cfe5174ca4edee5773fcb2fd1006db78d1df4983eecd547f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4B35.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4B67.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit