e1376453bce1188ab6618c9524a024568401e0aef93b5972ed32326ddc195c72

Analysis

max time kernel
148s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0863defa6c9215f7f0edf11f5c7b84cf.html
Size

25KB
MD5

0863defa6c9215f7f0edf11f5c7b84cf
SHA1

9654e9c3f468499e30896b71e361b5a61cc7e4b8
SHA256

e1376453bce1188ab6618c9524a024568401e0aef93b5972ed32326ddc195c72
SHA512

a46a28ca058199aafd5e1a40e24fb2ee43ae0ce2e749bd054c2d8026e887a11b9b0abf4b53b32d9dfffb974eb62b29e77ec086de63bd902e0c520f8c001d298b
SSDEEP

384:Sdg2H8olIGwPAUYOUtxKTeBfKTp73CWiYGgXLgWQQ/U4yhoy7jfIWrYc51IlSAuI:8g2HllkYltITe0dyBwXNG9p6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000006e363230a8a28223e0bb533f636e9e1fcffbe5cb961ed8cddc05ec1fb645e48f000000000e80000000020000200000007f5e64a4840a7319a3aebf805019c6a7a8cac91c5965c368cc6cb3383088b6f9200000003c4ad682bb18d4e4b1b5eba09c30a6f33085d6632770d1c796d893f1bf7c3f9c4000000014b4e239c7a9a28b725a2fd53cf1f71a0be31aa9ae7bb8e1736d0cbfd89479459f5c17e13429e61672fb084e43cfee53031f018c438ab4f14fa01df093edb403	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{094D59B1-A2D5-11EE-BE0E-D6882E0F4692} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409636518"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000002f3081ecef48aac0cd60739aba755d9f8a47cdf18e1e65ab99e2e2158941e10b000000000e800000000200002000000086e54b04f9ac156bea3113fa2644ccedfb9749bc15f28c104617756bee3ca373900000005fbd48a96e9fedd4140fc47b204f40334431f1b005a1ecf6d304f50943e309c8958e29c956ebfc349e26ea8db8bf93406b591b62faadb2bc16eef0185708928967271c37aa6ad5cc3d0044b6421b649ee9744d56b668521921b09813aedf428528423288a2524001e14e7b8193aae5337a2cc9006183021aad4ae0e88103e2609f022c61b0d9cb002463b3313da7ae7f40000000cd6b256c357254317ee70c448bcc83d512be5a49e710e41f5438061661f733329ba57e3d8db59da2ba96988f6c1fad296cce8001e2466d6fc727dd49b4b6313f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d021b9dde136da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2932	2248	iexplore.exe	28
PID 2248 wrote to memory of 2932	2248	iexplore.exe	28
PID 2248 wrote to memory of 2932	2248	iexplore.exe	28
PID 2248 wrote to memory of 2932	2248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0863defa6c9215f7f0edf11f5c7b84cf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c44f6412d68d5e85c93c62509d3f9a75

SHA1
17b9149fefc8a63041e42d641a387abd809a635f

SHA256
88a334ceb9c2f90517a74e5bd2648907f411efe27491248be220d35d8d201ca1

SHA512
ba7796b18d3867be09e3f6dca025f4cad2a2154cbf100d6332b34522442c25fd2cb2724a74fee95408faf387f9e7a3e0af77ee5184d6516ab8523b8ab5b8cbb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d69311cc8bb96752bbb45eade2e72e0

SHA1
26fc739c890658f490c77c780fd584c006b01c10

SHA256
685f37e53db411e420ba80c6b9f5e250324f67ce86b36876143f7b990e886156

SHA512
98d04c4e951c64717a6921edc235ca6c44370aa73276707fa70df2e77a34bb9a363dec74ddae7e1e5adac4acdd5dcfdb285733a3b0137b8806e515b21dbb95fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23b615d26349fd3f4a72351db8dd4b80

SHA1
72f5f01497d7f758d126a21e8ed3d627240f4fde

SHA256
8973592a35ef56e981901fe6b395c2ee4e84b6e935adb2716c4833962278579b

SHA512
aec1c7e6e36737a53ffab2f40f18b12a17003e1b333c5ddd8a8d62e185ea98ff5ad0fdd320de5b9ee2f8c508f4c9ad27550a4fd8290bbb743e2855a715c2b853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f641cc2733145e64fec3abd6126b56e7

SHA1
db5f63de095d146842c278be59b82088524ef053

SHA256
8714d6423e0bdcbcaf5350ab7df11052c01656531b584bf46f3b30989132a790

SHA512
046f47d40835558746faab1104b8fc4286c6c1aaf39f6e16796e9dec55ac4ee87ef222f457436e8cfd3d68bcf219410987c52dd014ea394150147752ea171b4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88fd113961925d84d86ccbd3b5078365

SHA1
086acc645d79b9213ecbfa858b4a6565fc5b0ab3

SHA256
ca4fc7d552eea59e7b652462bcf6bf6ea58ea7b4d6030348182004e5402336e2

SHA512
cf4ad7ea9172f909e881692f90b1e027342f48ba30bd28bd90dad963e81c6b9a174ce54ec65344d3786f6bf016e7b614eb83f9de2fe73ecfe9c88d5ee9243a6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8e4bbfc2a444f77140e7f9757ae4587

SHA1
2b0c76e3745eccd877247be95ad4f1d60d8cf5b8

SHA256
d872333d7e65b6769a72146afde2de28dd7f4f11125dd2c7a2d4b99981e4c6cd

SHA512
6f1348d181b86564a84d17367881d3779acb7f3c547d4b0977d1596b35797df97a921544fa83625d983fdec65e4378017919446cb3c9799176aaf8645a8a7c99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67a2e65f36392dea8f6ae28eebef5230

SHA1
c31bd0a5f9ae46957566ce8a213cc814863c1c32

SHA256
5c3cbd287e4bc891f3670c76b83cff8c6675e097f9e284ef48cf276fc3963b01

SHA512
a012925655861fda70449da04cf623d240001b303a5dff364ee19b86ee3a6c0ff1f811290b642f0c7e090e0019a79a222322f111d83790be2a9f22a7bad90a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a88a03b76afb5b42000019914490b4e1

SHA1
324f29a4e54c4ccd4ae8ef4757e355ead58b85b4

SHA256
059197a007af0be3359f16c4a036d4c3d79264be1f28e2dbc5581de1d334ae8b

SHA512
d8fc8f16a6c014f4460c639bb54cfb057deae7d63e2da029deeadbcb600d946dfd25b919dcb2cec8e0853824e0ccae5c883cab90472a2675af2ab197cc1e7674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
312c09701e26d8a94f19a8d0967fbcef

SHA1
2f848aceabfe8ed7692351c63ba20f154a92602d

SHA256
12209bc9a3fad4bb9cd1af650573185fced80cde7932fc8a5f49fef19e0a5bb3

SHA512
64b63b582fa8bbd2f7393d79690b2304f1839919b9b813749f8734a1e23b20d292a84a5d71d2bb3dd7565553ec5946b841aa62f490152ea89f65cb332c5d7159

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89da47e346de3bc718d6232a6ba6ef27

SHA1
ff0e4b35e5f292c8903a67856bf4323e3d168cb4

SHA256
e08cde2404a52e980787f99ec24417d661365568e8c239e6f1645ee5b8e9aa68

SHA512
2cfa6d3cb6e66cd357fd559a335caa537aa1a2628e939913f5ce32c605d77176a23d48c5c6f87381bd7c612901f2494c884b396fb29aa9e86a644ee437af739f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7d480ad43a0feae82439f411e59d475

SHA1
080203dee625a2bab6978845141f8109e1e03a2e

SHA256
1b69f2ae8284b2af50ba5fd471ccec03a7d087ba8c85cb4bcf16cc308e9dde8e

SHA512
a6f1abb91c03dd3de5b6923dff4876e139929d5fc1cfd4d9a903fd549b8a3f5bc4eb249a3cea623deb4302d60eade4f8a04d46c419477d09ad94855a130f0670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56eef5a9bc7ff490ce2656019b4f000d

SHA1
6c987998c01c9f2cb4adb41b5e7cea13169d349d

SHA256
f8ae383e44e4ebb8295ba87c3d9f8c4d0f73f4bcc4a6a2e4936cbf055a02fc46

SHA512
3751e42e95d4a9db8926a461993512cd6acf279a8e74f2a6519b3451708ded7f5075c2db096299b4a88980373aa78686a41d753eda6acad8bada95e41d20e457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af37a27b286763a027f5452de6ca205c

SHA1
0e84e5c0a5f222fca64eec9c1e2edb8c40da4476

SHA256
e46df864f2c35f21e3548aac98c327c2843ac6749141c4c684ff83993201de34

SHA512
5e92e8269908ded4707cdf93458824e14996a6ba90fa490fcce1417d28d0f67c74272409debeb6360034be047c89e9056b90a9b7e0b033e81c651ba68f7d31cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc7a54446a0fa4012a410d3f62a70c1f

SHA1
954e1c6d00b320df6f14bec5a3ad31b71af2730e

SHA256
73f627c9a93900d22143874258e4b5efdc4f8e25395457984ccb65bab5e3a8f3

SHA512
de82b2b23ee02a36b7bd6d74431b51fcf429803d553cb526a5797a6977a46d33d923b0d82c76a00a8fdc3513b47d354259f1e618c392d4aa62cbd0b63e43a061

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4cd0f008c5b4fa6d290cedaaa46473a2

SHA1
84fd364cb0c0333fa415bf568aaf340f152d388a

SHA256
ec86d45632da8f425dd436f44815535f0b7e1999bfbc6b4c59b9208897b57102

SHA512
2d8081b02d29844ee1ee5b01c1ce88c0871c8f1f2f027451c73719a20dcdc3a7e2d67a0bb7bc5f3d628f3af5eccad8e50222ae776e298f732e98b13430612a12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2AFA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B0C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit