676c869b2ea40bb970b3d7a8ae5bb03f7448c3d2e5726de47ff6e233501c65ab

Analysis

max time kernel
145s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0506e640ec7ea2ff0bf0c9cc3a0b0190.html
Size

36KB
MD5

0506e640ec7ea2ff0bf0c9cc3a0b0190
SHA1

0210af5e52256be6b41c5901081ed1b64a6b64bf
SHA256

676c869b2ea40bb970b3d7a8ae5bb03f7448c3d2e5726de47ff6e233501c65ab
SHA512

f134c3aee020ca08c202489b3821300650d1c83d6ae190df47299ed8ac8238c367698be307c26f60effba2f9430267155b58d2e78850a33a8f25e79530dade14
SSDEEP

768:Sg/MIQIzpRcYoFlBgsEiXDscVpl09aCFzY+:Sg/MIQIzpRcYoFlBgsEizVp8zH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409602544"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F349C441-A285-11EE-8427-464D43A133DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f73e556c6a0c86dba2817312af0f61cfda767798b3ad9c1f6e3e45a85751142a000000000e80000000020000200000000d516d889ef0e295d661a0e93f61558bcd048ed4d8c9156625f4f32cc67d0f0620000000ccf2a298d83e6940d8ef861841d55a55aab3f5aad09ee8516abcc04396d3b12540000000d4cc0a654eb43a5fc9fa7c8f94adf7c2f1a7909451b42bb0e95918b8e463624100060e73fbc871efe7c38d4bf68b8349b663cb37cb95b2e5bfdb97cf058fed51	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 901747cb9236da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e300f35f8eeeef0f8391cfe3d0cd35273406f37f53a870a968f906cc290d23a5000000000e800000000200002000000020a459a4658c29db416cac43e031b864f23e9089de454395ee917768835064919000000022e6dc6ea38dd59dd187bdc6373cf1fd6d92497315ec3fd806f30a5a80e0b3f24ed509b8b66de1418a8f97927eb48564b7b056993bb032866d348d300adfa344f48b02901ebf8219fc452ac6c1f6c2f636bb3b78e7f979eb176deff30030bba4c6468d3686413dd165a176288febe7420b1e3d000fe417434a378f65315ab5af1332bac57801a5193d97d86d152219f34000000082778ad9e81a9b33ed958a4c2928e3e8dc1025f8cc24194b392c547d1bd3c1db2ace2d9cf37b9d359711a669036a534b90cb0ddf47042b65df3da0330651aef0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1976	1984	iexplore.exe	28
PID 1984 wrote to memory of 1976	1984	iexplore.exe	28
PID 1984 wrote to memory of 1976	1984	iexplore.exe	28
PID 1984 wrote to memory of 1976	1984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0506e640ec7ea2ff0bf0c9cc3a0b0190.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da2fc739ab4c7182b673e10dbedb07ab

SHA1
588f77f24bf77fae5d8ba6c4c644319f78180054

SHA256
ce454c86809d564ecbcb417958297b7984404db8f1fcc9d4b86f006a41c24802

SHA512
5241ab876bc77d65e0693ebe2831de695711b9a3151c7fa1a0565900ce75a664a95ebb20bfe1b262e85570a669d24232826f3aa62f3038ca846c9b2b8ff198b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01dd887f59eb947162148775239ef0f6

SHA1
494cd4b5f950549c2b348fa8d154c2f3776570c6

SHA256
caa2cfbe6dc03bd37ca9c7cccb779d7f793c9f122e7b8c6566efb50bbc9158a4

SHA512
541343975fcd00bab0e21e424cf78c48d93a3ddce0f4f57b09b2221891531f47e1cacc7679fd058261339f391ce599036927cbebc700e5e9056f4af0478c1932

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6ce24ff60341a163d327cdbb0904685

SHA1
aa6c18ef73a173e314b535a2c622ed7b6f4e9669

SHA256
524e8fb133ee33eea30ccb5418a30507fbeeaf3529b5a5120905920f8adcade3

SHA512
ae5a4134990ffc280896f9e3aba67aff7b3a40951ea0ad6619d4bb28c8c303c77fa5311b14504cc460b4a41162fd189a513c0c5458db955a2f8e90b3ff850c5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c387d004569e98e1aa9392088aa051f9

SHA1
cf23430b2140ffc4a03da153b9180480711f7479

SHA256
9f97ef277014eb5f8476002371f109d91f8dbf97e2b51f5732d7200ea66d5389

SHA512
cfdf14a35ac13a0bda535d9c61e1f9556eed9dcc13b61c6a04348de178722429e8c36d2e1915d59ddeade4b42a565b4f43f8e273e035a1306f1f20eb07b196e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1295b9a78dd36cbc957a42b869906bd4

SHA1
ad880614742fdfa91699643fc6a3882b9bfc104b

SHA256
9a7c6a1b3083c76601b8837ddfcf62059354dc9d6d0470d26a0bde7f20d5c895

SHA512
b4ebe6c5e56e32e77d0392f82e4c76a0b5a7eb739af61ec7b7e4ba2555f825e6c05da15f28bca15f9f5802a058c43a03ea2f37b4b8c98b2715ef285f4b69e06a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a8270417825e13823d1a5cf7aaa0ff8

SHA1
6fff6a3ff678be7060ecbb4ebff7192429ad3c63

SHA256
2a914988a579b5fc61583e871ba8288559c56ae0f91f71c33ac286a9f836041f

SHA512
aef4a42e1298c4a8a55c74924e524e5bfea08abb908b33958d28ec4e876155a76595a492803ea034f6316f9e42c25979837f0e819b71d2731195b36e7b684968

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a321c5a9008c68281a407d088715cb8

SHA1
8bfdcf481cacf622890a360273a1d1dedb6b7601

SHA256
39e3eede8cbe31407b361a15ee94e46ab5878e5b743b18b5c52d199979f287e9

SHA512
3a312d94681003f721a62ba87213455b8e86ebff966522bd8a9fd4b29562017a7f722cb9b094abf6b2dbba39caa353433d05b1974560481e7919605c53d0d4e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
056db462d8b428d8de0df9eaeb26e294

SHA1
cce9dfaeca5ff9cbd102abee6e189fb18fabbbb8

SHA256
cb880eb7ffe52de5e7b92bdb9ad199f547302f20fb01d7620b8d132dd03e9ba5

SHA512
c8af5b9092e76e3fafbe7982aa218edd158905772fa901c6dc6496851c317966623cbd2ece9328ca3be567a9d0c087ad68573eee83d2eb6aa335c5852226b5cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6197a21bfb4cf2744ed2b916f32eec91

SHA1
62124ee704cc5c77fbfe33ed00100b88d2e52a55

SHA256
307879c6251622f68980e1b38378e1d4ae603ad81de11b0f469cff2acae44523

SHA512
9d0ef8dc0c56f07328f55c1d3c37e6b177023e75da6c4c1b49df748548e9082eb929bd1db5f9300da8faf1c1f8fe4cb555001c1f847581b80a4c5989c83f6fd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\f[1].txt

Filesize
34KB

MD5
d854bbb2246d993bd1f8687e79493f60

SHA1
28fbae93bc5e4e99a6c905fdda488be72057c307

SHA256
707248d75606cc53aad966797dc2cc86997d1ea1a74b1c99b9191716600c74e3

SHA512
ba4e7ef0a590c84310fb36ea64202cf821058eb7bd52ada1cc9fefff544b7500bf54a8ee43ce80b6cf8989071b0deaf2bf9a50c8063c192f24063f318585c3f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9AAC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9AFD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit