dbaafb23c50e1a95a7a5b55a232a8befc45b15a889013afdc04fcdb8f32aa854

Analysis

max time kernel
147s
max time network
160s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0483c02d7e61b6aae6963e9e225b06da.html
Size

40KB
MD5

0483c02d7e61b6aae6963e9e225b06da
SHA1

e13d576edb336ed715267601947cb00266672db6
SHA256

dbaafb23c50e1a95a7a5b55a232a8befc45b15a889013afdc04fcdb8f32aa854
SHA512

592aaadc8b1b0e3b396a97fb9d8dbe1e2eafa39799488085fc0b4da5b4cb4edc145ebf5da4af137521e72356a29b5428712192c57720e3ebd305d1a15b6524f5
SSDEEP

768:JATdcqpX/pJdg5I4JRj8twEotJWilE1FXk9CBzYcyWUKaNtH:JATdcqpvNg5I4JRItLotJWilE1PBzYd3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000051c5c079eb0608dd5971777467e03344771e30be60e79a99f598ba613e8103d000000000e8000000002000020000000a6f63bb49ec329f24debaa40137e69e0f676d2084bc79db4d42ccdda8858618d900000006a79afb361f37b8deffc8c27ab7f4852d3d933b293b1adcc8676543a17b01958daef2c69b9fbe87b9e6ba0597d6875a63547afa04dd335d0a58b50589dbdf8febce7f5f09252264547a3f29b5e14316c17572c8a9dbf638dddcf6d4e3e458e828427075d79148fd7d64536ab26939c93fe1e3115c80268b78f8afd4733bd8975e8138650d063a301990c102597b8968b40000000715759bc8920501fe00d839e74df13937411024518b5fd2589112a03108606788e41ddbfabfbd5db7946460fd0a3412bc1b53d00b8fcfbc9230b32d49764bd74	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409601072"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{829272E1-A282-11EE-9240-46FAA8558A22} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000d3566f46b79cbb0f05e8d29f13f4271eba5fd4b327251f4240af8e738ef3a45c000000000e80000000020000200000003c8eeeaf629f292a8111d782e654ba043b731036f480e69a8eb74ebf516c099520000000f89331a1be39dd748b80d2c6630b4aec54aaea822ea88bcc21b336dd8077b542400000001502c3fdeabf7c4ed0b38ed8c2f41c308a25bdb845c65e5a26f263635ae14129aeb82e0c815feffda915b228c2566057af63a1ee7e494ee09502a84d38686cad	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e4ee738f36da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2428	iexplore.exe
2428	iexplore.exe
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2496	2428	iexplore.exe	28
PID 2428 wrote to memory of 2496	2428	iexplore.exe	28
PID 2428 wrote to memory of 2496	2428	iexplore.exe	28
PID 2428 wrote to memory of 2496	2428	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0483c02d7e61b6aae6963e9e225b06da.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
761538f1476a5e28146b900f12749b17

SHA1
e8a4a83274ce4ba255ea382ebb8156ce616a4402

SHA256
64c64730e947debd256f82a6f4c8661233a53e791c8b60c3e09f49598e2e5228

SHA512
b443bd520432cbab9506da0434b46bc9dc373be82cd31680f993b8e144bd882a5e72001844147c45fb1c729c2f4f2d0f1d730a0d5919a648b8654b980c5549f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d87a6f19bdf3d4dc2552932889405b8

SHA1
77cf7384639c3d5f8a86db4660df66ec1749ad8e

SHA256
d9a2d6fca6a99ab780799f84c822a17c98032be0f334153ffe866e41ccadee23

SHA512
17c23b9b966de27ac2ebce8b90024bd9c8ead1926dc1cbdd853c0dbbb42becb2d5a97df398f4840d21312456f5d856069747478c92263cf035ceabedf3d2baf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1dd00531b3a1d3e2e14909f137930054

SHA1
2c136e33a5075113d9c5834c0f437b186e1e2b95

SHA256
e4f1fb21a77477a1dfb5de58be89a6dd1d8868511187ece080ecad9f8ef472f3

SHA512
490680f8b055ebeda240dff54302b5185c20ff897d865ebbc948547f813ad69ae55f71f0232c6dc3a8a08839c59d90d4cf9a21eebec471f5cf288e117ef2ac81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
404e9b3572d1c9cd6c2db241a2ec8b70

SHA1
574d4c335b9e23a7b6b1a2d67e4bfbb1b964a660

SHA256
268bc4c4fa50b21ffcbee4a05d45e6522ab869d15b1612b078129f779186f700

SHA512
c027346da7d4dedd44637802f2ec30561011de8d436579c7422f30862575be492595f14b09a8cd40c78136d27064e744c864bbac254fbe998eaa72f05e1ef9e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87f438af7d7a43ef2d5835d251520313

SHA1
c4c7c2d6622fb07878a75611ae3d0645f21321d3

SHA256
d9e0f5507f84032d87691a7240856a648b794c9921b9ad2e2a845806a067b583

SHA512
580addddad302a2dddbfe54f5a2da21bdbc00ff586cdf77dad368ce44ec37eb769ef12af87bb0039c801be9dba8d79ef81349d8b7e140d5b04eccb74c60b1d2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
415ed74527553dbd75da5b6a45a336a1

SHA1
f38b5ab5f3e0213fd96ee0d39e90199dc7d70666

SHA256
49e11d950645271d56c279a55aa4fa5e49743f7948b628abc38ab0ffc8370a34

SHA512
7eb666c6279edbeaf707d7f70ff038bbed27ff63281e8a527a7a270d9562a4eb06c8375d23a7b1ca8e62cd2dbe11f24b09913025bfa346b4891dff819c41b0fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c65810ef2e37b0ca1643907149c753ff

SHA1
7ce3c27fda1165e8485cbffd16a080fa5d977315

SHA256
2567e5e47aa8971ea7883d9401cae5aeadf072c1f01697798e7dd8c26885d43f

SHA512
a41afecf2e4a03ad9b0945776bb4ae9361aecd38271b45a38eb572e275643ca9c8873d2c997d5565289722041be84545cfe35637f1ec09afb82dac1fcff2b537

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67366c9339f085c26cf723810da351ad

SHA1
685efa7dbef5c59857d59c333cad147d299ab9b8

SHA256
57ee1dd6a0eee991255fc22aad62c514ff685e102298bf3c69269a3972cd1460

SHA512
046f6b730719e196260359c452f2243ee84090ced27c2310e701d300d6baecc3b2988f6f46a13d920144057729aced7e978dbe7de8f876e60f8d56f17d4716c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e8014bb6ae13d797d9a8e8e39f135b3

SHA1
b5f4d71ff4484c9270d5aa6c774b92ec6b28808a

SHA256
54f6e5c9da62c83e294ca5db106a6f9fd3fc6c6a95319a18b14b9efb1231a1a4

SHA512
13bdaba07b6589f13e80ecfa17a62bf95997e93eaa1f98c82252b9b22462c5d9d7b7d5b1c51e5ca54db403e8f8bb2657f4901a8232afc9aaa7ec307a468f8216

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1aa72c930459ad4b04385bf06ade9df

SHA1
7e1d94bca0ea2667434fcfeae427a15096f1b762

SHA256
e568f8871b7fc1872f8eaefefb92ce968bb649815a836658db1c165a50227435

SHA512
5d99b17bc950d000f5368e82c7d6be5132504786c6b87089889608e3b5837e5bda21d5d925446c68f8fbf81f3a1b878b293c366d1408b3cff4be335a8ed20806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a37861394aac3a91c508869c2365ce7

SHA1
ef2cd125969e3c97e6e918d95fbafad45af4bfe5

SHA256
4d17dc58553d5e87a8567e1f5a455f639a3cb576c447cab2ae454ad1b755f543

SHA512
f22c0378f6de2993a4ab5206d468c97bad36ee1163b8c03cf36d3b95cff533cfe993795fe7414305bfe9eb60147ed891f6c12544c63aff42490ce2ecb45b9ad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58781cfbd48593660f1fc80edf9b06aa

SHA1
34935754aa4663b01b1b7a236c0db28a3e77b85f

SHA256
0803be6c7019f47e26323c72e0eb457017579f8c02922f79ef4f200d889be96f

SHA512
292fa1662729bd0c6570e678043a0270e0361d9771632a86164d09bf3cc1a8419b4d64fe5f6b5b8d292bea4e33afbba2bb23c28c0ba6b804c3e9abbd9d6d222e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0107aebba6a2421d9cfc3cf8364757bd

SHA1
681104a68e4b616824be4fbaa504be5b9691ce7c

SHA256
6672c5954dcdda9832a503bfc7164ff0e922cc62f43bae0bbedbebfde12e77d9

SHA512
a8ab3b603ed2ea3b9e7f6d450960c44105af331c7db06bdf30443ed946a49dfd7bb9f3fca98e0cd53420ba3b364a7b3ae8accd2999fff95df8d5239aa6806c3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16c8647bee89c91cac839e26d90498da

SHA1
6bbe0077ba3a1c0feea59bfffc6f12d753ccbba2

SHA256
41bb7182a52b2f27ea7d8277691130fbd4c1618ce45519e8f11db53dda98239c

SHA512
615f5aef0611db820dc51515c1acf66c0df6545d8bced1218a6d43d288278a1c4904ca85b35bec7940bedb468e099d9852217adb7e38fbd68aeb9a30c2a0bdcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac4321d86ef695390d8e5ae2e0314137

SHA1
8b3604c029b97b869ec1989d379c499552f8af08

SHA256
e94546f5c5b453a92d8114be9ea8e6bcb6e51cbd59cab955324aeb27e7c843f9

SHA512
09c5947edf778357ea2aad5800d9f1ef291f07e03644f76a4581bf92fa14383c49862571327aedb21245894500ba1935d91f9c3a58726c303b3cb3a955688d54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab405D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar40DD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit