c78235b17dd79d6573faec5c7b3444b946db702800ed1257819369f1bcf3e75b

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

046efb5623315c6cc21d7e5af7aea0d9.html
Size

44KB
MD5

046efb5623315c6cc21d7e5af7aea0d9
SHA1

d769b822a2e5baa6d93df82f94ebb559756ba78d
SHA256

c78235b17dd79d6573faec5c7b3444b946db702800ed1257819369f1bcf3e75b
SHA512

f2ae7e89598e9632a7279d3643a1a4744ccd75a2878e5280f12e0d75fc5667c7a0ed8ef2fd8e587730c5db59906e04d3a4faa9408642dddadd6a9f201c4e4c78
SSDEEP

768:mwS0l/sGVLsk8ejW4mTNn2ol1elgxPxP8SNdk:mZJtf1elgx6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0648e0bb636da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a41be065b7c5d9b878aecdd3cfbfc852c4cfe0886c4bbe387e541ae6b60ab7d0000000000e8000000002000020000000319a225e71dfaa0a62d12e74b9ecf310082c6721e1cb6e1ddfbf51b2f9c0d7c590000000eb93117ae9f26181baabadb01e46f94f447bfc146147acbcd1b0a5abf9f6619afe6979554c6ca430c142feafb5f80cc86250975241cb1fb2d35b67692a2605ddc3a7f5eeafe786fe1a03ce6872b36e7a163407f7ffac7fb907bc8736e6cf27755e11d82f43082d9327f095fe280b1ff35ec240ce609b7756765f34ecac6e84985e80291fa232444e4b1fa129df44c2ff40000000cfaae800e7bf747b7166250a7c7fa4231e29acae527f54ebf3a6910175f2aa22ba05dae4b2d88f63febb1874fdd52508521ccfc95424dbff2c72e4599b3a8b39	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409617608"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03A517E1-A2A9-11EE-88F9-76B33C18F4CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000013043f9ebb82abf81703b8f983b1405e1cc60b9fd15b1265c2f11affc8712696000000000e800000000200002000000096730da1f18fc565423c2b9735281a464fa67453285b21b32d4626cdf078d0d120000000de21cbbbe05fb8db5f0f87e510a3a6cdd1d697fb8fdc6db86ca323bf7e04780440000000746df0906ae00ced20892d8bb926bd49ba2408f7d83471e7e9d5975f39a5752ff6218b11bf418c359070ace9dc478f27e5eeb7c44e93f80246d1dfa89de7e8ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2840	2212	iexplore.exe	28
PID 2212 wrote to memory of 2840	2212	iexplore.exe	28
PID 2212 wrote to memory of 2840	2212	iexplore.exe	28
PID 2212 wrote to memory of 2840	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\046efb5623315c6cc21d7e5af7aea0d9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0a4874fd3f6c47f5b5cf0e14c258376

SHA1
555392d2e354ef979fb301649cb14cb687f57444

SHA256
2f4678b31e24388a6c5784618214ac82460c1065bffa5c9cab68bf6da7ae4631

SHA512
713fd3810de2db77b8818a4da4780a37ff5afc880434d1b92772f042266138222b2897d142d2f6022f17fcb991a3df3d2fac7649a2783e8d485928b382a8d731

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc434d9894e60cf12a55b52561287da4

SHA1
eb96fbeb06db43334df149c15e2cebf05ad5b7da

SHA256
9edc3dee426a102011d70af34dd9a321c85c51837e42ca4c3b9cf9483a12cb30

SHA512
5fa2fcbefcfa348fd434fcd32d25c832ee96cace3723f3124b6f4eb403da5bd37e7a231f81805079d8d73882719404e572c09d3b0b691f6d6760254420f255cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a8090387b4e1efd3b737bb8a4e0fcdb

SHA1
f1f20daa53ce6560a83797804e00806536dbc98c

SHA256
8d4e974ff1487e1057358be0dd603b0f21e9700942ce73efca7c63b611b79ee8

SHA512
f6ddc4be45976741c7d30b843f9491f2306f3d326209e8850014cd526c8981adc50454ef9a43d3650d3ca581f4a607138386a24e35f858d35449e9c6ca5a6f93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ec50066f98d2bb124d5dab85c5f2de1

SHA1
81bfd5d964f6121b89de9922c1173cbffe24a710

SHA256
8aec9cfb8f4565859e623540caf33e4132efdda860d0f3d6fc52b402ca1b7468

SHA512
9d193ffa0ed2da4a04c6cc638a4145e5fc68bf479432942b7471f7510bf5eb3ce3850f18450bcdf0d7fcd6757785a9cd19cb761a304547b1331374d1d4d65efb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71828860bf2cd43f4045bb7a20f96da7

SHA1
9430d4a23414ae619783d1792cbd63013ae5bf9d

SHA256
cff9f8e91adbafd6570819a9a8d63dad7f74d9c973919e89c060eec3cdd89f13

SHA512
e33efe30319996aded81a51ba56e37ca85e161148ca3acfb84163600acea47275de821d852a622d8f99fd47a14c5f5923ad54680b0f6d4fe3cc648602cc67db9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e4f8bca5631bf2c5e1323a722914c31

SHA1
27f2ae3a4aebbae8ecc7315559745d24e6df9cdb

SHA256
6abb8d03e459e701d406bcc04f4e8c9150106b04d56701e818acafa4e1b37296

SHA512
f06cea27160b89e2eeead5718dddc06854202f77618adf46ae1e34ebc86a5bac49a314f76a0fc1b3cb24cc50ac2fa4a6da275cda0480c77af4ccda6e78254dc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff8261e4c40b046d1bcebd1eedf37b09

SHA1
74d5a7091003bbcbf50ff03e35c9f0a669c9f93b

SHA256
8e20fb24c0aeffe0caf4267d6a21f431616e35a8804c3e6ea399c7701472e72a

SHA512
17f91aad77483eb9f630f3f84f708e764fca5f266c5033792f0338a8d14cd647a8ab8604c2f154ab70fd76b480c756e14a4e7c0b91159052479b19e9b044e8b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33170c2c74ae0aed963fbb47017c0949

SHA1
20387f2bf7f3726aad12580f3a6fb8bc44ba0e96

SHA256
f4bbbca477f7eb854bdb8399cef3d195321f021a58af1034dc7e03308cd2d9e5

SHA512
dcbe76df60009bbd263d63d5ecd7c07c893a239da07c7686b397cc04c5a3a54cc4e3769d9f7eb036c3e5deb26c1b4c529407d6fe5d779d208a0370419d622efc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
845935fedb422835b4c15b8fee8fb9cf

SHA1
4de2ecb6f1e0b88a51bc6149386bb4d523794658

SHA256
4fdca755c9e1f4030e8940a18effd5cd4b8878da0ed3a333a049a939ba73de3d

SHA512
939a27ca38cbe413fdef966b2a050b7fff2c2d0146a0b28f3fe1fb6494aedc55000e312a14ac969afee9db43471c246d900d6a6c759f18d474df7467d5aea5f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f65a8ff446adccefd1679ddf4c8bae06

SHA1
ac751b9285048465f7c45b168d5b6a35eba2e5ea

SHA256
1023e0b6530260eb90878135dad763f6b11b4b38677c8910ef522b57185d086e

SHA512
f315945edce74464b8fc865946ae726028ba8da116a860b3ec11667d85e57165bb02622d86661120b5a142747f9808051f4f06dd965d0112289c8275794052f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
449fe3573234e5ab481730f80f6b2838

SHA1
ca81a7e6648a3e2f118dc3739edfb6a5c4bfb958

SHA256
1917f3002e25428e9bccead2183069d0bda0b132f4fa2ba59aa35e249bf11b7a

SHA512
f8d41fb53aabbf0e6ec0554f78de71dd8218591075f881d224f8f092153ae923e92359f077b9c380787f919ac39453b3c77b405c4c6ab63335440cc2da57bf61

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB3C7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB408.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit