8595894afbc9d47583a4ea0edec6bbe92bad832161e656bd4423c413703b0134

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0769831f87868bc655e6af6a84b9a4ba.html
Size

16KB
MD5

0769831f87868bc655e6af6a84b9a4ba
SHA1

45445f24841fb99b96263c6e8c18d7583bf53f5e
SHA256

8595894afbc9d47583a4ea0edec6bbe92bad832161e656bd4423c413703b0134
SHA512

b99aadbba548a3d5f009612472205aa179565ca16e417568cfff4de804a34eda1377ef8780ba058237f4ba20d76f55599bea03601a56428337bb223b35eed9ab
SSDEEP

384:HHSwgQDj5TBpL+hMDpU+H/YHqjHlJHHdtHAzPmyp2Iw4kqxdnNBDMwVk6fVVT:HHSIINBDMwVk6fVl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409608508"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b430258ace3331241f280bda913b3f34dc66ac2fa7a6207ab64b00a20a68a2e5000000000e80000000020000200000003fbd472e2ee53a603a3cf45cd0e1ec07b2e9a61393c62349a02e335e8448a2a79000000052081cec5dd126ae456271f3de2bfaacb039102721f7acfa02cac62a0d5032e718fb7ad941c04026607cd1f4c276f68b276a3d0db0b6ce678a3240c9bcfb3f9e3689b9ad25890b6e4ec7f79bc6cc7315c72e405a305892e9b0e8eb406ceb142bcbbca2ca8a789edf8978cddbd089e2517262405a6d417feafdfd03ad3ad91880772460e33a15caf7607ba3b8b30d83f04000000029d08b93ec356de03b3414c328a8a61d0ec2a4b27a89720ef623b42aca70a40b0971144428f043541a4c4d83529a63b9539eff17eb11a030adf21b65a1c342f7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF3DAD11-A293-11EE-9D0D-D2016227024C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0cc3db3a036da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000031eeee167815b239dfa2de8aa92557d8214ef58b67dfc63c902a041c77bd0ce6000000000e80000000020000200000008cb0ed5264ddfc361d69b616762ab2d10ff0f312e873f2c3569cd63ccba1a1d820000000e835e7de3b58652863dedfe4e150f0702d684127a2f537cbfdb20bff24b1572540000000798df10dfc9c968c5fe4fb436d0984fe7e05baa92c59a349bdf1ee1101347b43fbb9af0b304e062c03ae8676a1fc2d2b82e4407cd79b41ac0841a8a72e23a110	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2240	2108	iexplore.exe	28
PID 2108 wrote to memory of 2240	2108	iexplore.exe	28
PID 2108 wrote to memory of 2240	2108	iexplore.exe	28
PID 2108 wrote to memory of 2240	2108	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0769831f87868bc655e6af6a84b9a4ba.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f07884905e391dfe94f98463d06bb806

SHA1
8250f940ed83f7b07ff852489503238e3f84a07a

SHA256
7c3cb38e8b7f93f5aaa985c6bcafe52fc37bc746d918d044af280b4b15cc8544

SHA512
0d20601947756cae98faf170f455debf95b3a62b0fc29c46bf2557fa4f166e542a6fbb2cf49b07f142f1b09cc86fbd31d94b3c9f00f37ff2765e051f87d74685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
726daf43eca94423ff342870cbb8918e

SHA1
ee977827486f61a0ab7b9817018f8cae741000d4

SHA256
21ba96c7e70d5594d141d4aebda77f75d10800dbcb07bb49a11d792d7e1bc806

SHA512
e4135b41ddff3cf81c70aeeeb908da8101758a271f3c497d39f0d8c840889ad6f37d8b8619e2fae981ce03eb51bf744ff82192af52f4e3ebe7da83b1ccfadab0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a2c81ceabbe1b2452e16f63ba8ccc9e

SHA1
e9bf26d4367a891e9213a8097e9e6cb67bb9f4f4

SHA256
01b4755b3447941dfab02c5d052ef1601fa4fd6572d0d2a46d2d9854511b98db

SHA512
07df8b9555ff81f3c0c2ea25b11fe7287808720463e128effc1c3db7ce9adf911f89a89167ce4e81308100b391118ef245eb382c0671e98a0e978d5504eece95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d8cb95d7ee4625d46e49fc7db634838

SHA1
cd3547fb3e1ae84499e16bd7d4f305b8750c29f5

SHA256
25780947bb102e4328a7c5d8f20ac93da24a69e687e61722d57f2ba3bb41f420

SHA512
12d6f43ed60b49f9cca3c6d5a4eae82db3d495c6b886089385cc0af06357faa98d20780a440ac1408726eeff0288d6ba195a101b2c2375ab04518bf45af02a30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63ee5329bb952b49601ba7f2e9d25db1

SHA1
e116b053b9f87599ec313d1e774d0df2c577ba47

SHA256
22d8d1f01e6f7a57dc610791e01eedcacac6db6e3ed3aa6487b2c9c43a84a3ac

SHA512
2a43edc05c8aecbb08061f21e617c19d823ac7cc76c21575fbb437ae2d951f73caf6e35ed275e1757d2859b4961888cb28ea5f77f889ad6e5f7973850a297149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3094d863aa77b9e928ed75d7efa98387

SHA1
f7f7bc183a44eb63f08d7d25fdf26fb92e8f3e12

SHA256
8360230b97d68c7b90b59abbcaa4392a5a7de0113ba0ce3725a5e6e2db532d46

SHA512
5b831a4e6e4a9c433d90dfdae5e7fb45ac845c2bee4f7e2ab089f03fe07bc705b0fa0a83c5f4d82747044cdc9423757ac95e34d091040fc49aaff0e2e2bdbff6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f00ddde70dfadcac9f62889e44859eac

SHA1
4fab191996017c8102033ba312848918fe9f2e2f

SHA256
631776c2e7a9fc989c9acbd420cbbc3ca4844e89aa8bba875ebfe7c768e48b90

SHA512
89df131cf4b0f2ddb81c356d433d25889e6df9b1e52e98c52d73a615ee5717be28c2c86e4220b1283e8cc07649db257510a46912e692a84a42cebf9ad379ba54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f6292b7734bbe7bfaabd87e3763e321

SHA1
2e4c88994f8c250e433406c4f634f6691cb2f862

SHA256
b68ab323c3d86fc586c06a8840a77cbf73e43c2f1cbb723524d27b2e491bd076

SHA512
4e31f32899c25cda468b4f0e00c361ece0838ff913b3b6082e0c1bcd044d9c4a672198c811d45296c003f8ed9a5f0429554f5b6b51ef820d8e2944e8ae48d0e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d7069914e5754d7f94bc4ec0d519568

SHA1
f99edcfc1003b92bca4d07858da11c451c06ec21

SHA256
bd92dde59abeca896e7e895ec9e51ab8e06059ce1cf47853aac1de2caa495121

SHA512
199bcce0f4107b99ab9481fa6900c6b1bc3e43aa0d44c4e44a428a2450484f5f2f4f4ad5e073a0b33e8ba78ca1fb478d381781b373a79dd87c34574026475c04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed542a4ceaf6f1f7069ae9e68f80800a

SHA1
620694dd3ab833a43df9bf6730d990d117efda78

SHA256
48ccf5b3c1f1d72dc489a33b0017be6fb9294011e180281fb5f494e9a96421f7

SHA512
93e857b04ee1e39c3b87de5217e46055ee92f03228915ea883ce0faca1b68ae3e91f458b2571b9b32a356abc12ef7f145e16798dd01397ed86df24f79603c0da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3e8881bcc7a2a3fb5740128b5379b5a

SHA1
ced156de8562f2237aa2e3deab42d1065e8938c1

SHA256
8825ce00df959a7655ab4beb428ead62927de4c8dd888872b9ff209772aa5dc9

SHA512
04329c020d03b7798527fa07c9dae68a2358ae9f120f31ff2bdeac82c55bfc925af1ca4eccc3b7d1f03b48760c50f472d953d49385227e999aad386edcd62747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13b65612b3b6b36da607306085a2dc12

SHA1
1d5297e497bafe606424f1f9c341db94f1559d79

SHA256
a35ad956ab1f0713d8e5dd59d1a8ad6209d0742d770ab0049d4bab55d8f733f9

SHA512
12e01e960eafa5eff2bb6c40086e0569e1994fbf6004c617ae91c8e0ec42c30593b7499103100af7601826c856c262f6cf036709496db5951075f94c9e1d5e31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\sha1[1].htm

Filesize
500B

MD5
fa12715604296170cc8b0c166b432bb4

SHA1
335fa54acb0eea37a7644aef344e2b7c3680e795

SHA256
4445c56380f2ac645c44c3509aeb04e68e2b7a6273d72ea0d2be5f78e1ec3d97

SHA512
25a277ff335d1629ef5e4cc729266e08c2ea9d4cbf75d2b939a63aebdff1425a477dddc2334500ab689b3b281804b52996ac4a85835ad0afb461b388fa369296

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE226.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE6DC.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit