dbd1d571a57f9e597b5f8c895a86e49a26e71a5d0a4fcccead102a7b154c43f1

Analysis

max time kernel
141s
max time network
173s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bae52e16782eb69e964e1bbec25bf89.html
Size

44KB
MD5

0bae52e16782eb69e964e1bbec25bf89
SHA1

db76961f1cf71deea185c59d11bb15480c9e878f
SHA256

dbd1d571a57f9e597b5f8c895a86e49a26e71a5d0a4fcccead102a7b154c43f1
SHA512

67e0bcf3acd92233c66d7e5a62bf16934a18d9bc428243ddc8fe64d2c93a369123f3fcaa8d2178242dffdd48f0ab36cdd22e40197c1e363b32be8fb1418ee7a3
SSDEEP

768:Zcd9QZBC7mOdMMppC5I9nC4EeX+j36QPd:gQZBCCOdh0IxCBeXTQPd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC61E571-A2A7-11EE-B201-CA8D9A91D956} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603a7fa6b436da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000e407aa37dc00a9970e3e265ff14f6667770c197008a535ddac61e149252cb11a000000000e8000000002000020000000af82cf91e9791ea653a7e95d6a9ca4e1327c9ca6aa4875c8f842d26a5c6420e590000000a607bac0f19103977623a036352adab00e52827b00af7c9c972d9a26309b86171009eed0a13347619d6f7695f0124f0cfe4337f42653248f4d216376d35a885d03c5af465b0d4616325c8412b201d099a8219c392c7f1e3c10a2067437ea842f9960d461a195163d64ad2f559316ab9993ae23a2beb0df428433708079cd4b5270d034f084e6b67cb975d06c727b0d3d4000000054a89a4fc15870f08b7f973d7d05e0a7661a33422436b1f5a58197308df175f79bbb1c99b1f2673e020c0181984a29a759e70928a3699d24dc15625a0df0b85c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000031ca91bb1ea92a9b521b6c7d6b6f51a50588f7ddbca0f9f69e9ef1084fa3b8ce000000000e800000000200002000000061af12b2640e7d116317012bf2a6e080bedfdd4b662df7d1528591737cbfdf3420000000fe17ca66aed8b9b9748e954604cefb402ae6a90df4ee601e00e17e9ff1bf7cbf40000000fe1dfb9f9bb24b9d16f37deeb567d309de5e3cf71f8df8cebb59f4b27c0ea882f6b6f883e040f5570a3ebf7287c605117e58d34e89cd247757f28797eb3ea754	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409617084"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1516	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1516	iexplore.exe
1516	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2704	1516	iexplore.exe	26
PID 1516 wrote to memory of 2704	1516	iexplore.exe	26
PID 1516 wrote to memory of 2704	1516	iexplore.exe	26
PID 1516 wrote to memory of 2704	1516	iexplore.exe	26

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0bae52e16782eb69e964e1bbec25bf89.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbc96946906eecff1e425805d717af34

SHA1
96a80c64ab2572d958f354c0bf71220df8733d73

SHA256
9756f372b783303d83923a7f6a82970e13c8d6eabe130c127525ca746f3bf256

SHA512
c78d92741f8b9bf8b3e51f9da7c2e0f114d737ed206f9c226f0de978d6917f9bf07aafd417139c5503673892465e794a36c91bef8ef55746518da7242b20a8ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e7f0268d026003427d592a7507cb4df

SHA1
08f32262090bc75d1113d6bd04615af0b79a943a

SHA256
ccebfb81b830ec620a577a603e5aad611ffef71300771ea127a45e4dbf50ed39

SHA512
2f4300e141fae131a0363aa5cd006754235ff07effa45d033b290d05e7753a0d7b3e5f2a5e8b46faa8c0fca76d7f92be6d23d266d6bd6b8bc46870a1b735ef47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf485a9d896445143a30c0bf9cb23b0d

SHA1
2083ecc0f36df786df2bd0c8758a9c32fb9a7978

SHA256
b71cd9623ea789131c27b1742b5e599f83fb1c8d0fe319b8f05236281b32e447

SHA512
f57e32215272b8c023f3a7c5d3c41f843fa94a022d2acf762061d9ac28c4ba5f11a1b59e61fed66ef6e0a7c1ba97168ef73f7476bda4242dce7e41eea5a82dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2edb38fa6699a5f07f80dd2754c93ced

SHA1
299d5e02fac038e9eca327bb4632752ebb0589a6

SHA256
40fbf1884e0fa61bd9343e9dfce4330d530f2a33cfaeb2d2b07bf943b0f5abb9

SHA512
f29ef227536f8df7f7b27ff556b3955a739f00681c090633194d7a46a39813f385170e89824abd8564dc7bccd2bae579afca82979d981159aa9035728d0537bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4748170e9568b2efd7fa829b637fc4c3

SHA1
20c64bf3fdff41855a344464c312b5dbce446fab

SHA256
827ef1c0031ad44e04fd0f889c71e04a1cba00cad07eca1a7721a0fbbf7c9ec2

SHA512
d8955345e4acc4146c85c7245f3df81bab61102d257da96b3d488503b4143864985205118788a52ecdbab3cf5c782f12941a6bc6de3735c6a0751fb501d868ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1edea646b39e106eedab47c8382b1695

SHA1
7136d6fdbfff527c6bcf20c042ca9d171a40ffdd

SHA256
37660268830946ccfd9915c6910f40da6fe6e21220767a6bd3948a0826ef09d4

SHA512
4c53c7633a1284805e2426c5407c62a41ea3f56b7adaa205e58df06c184b39cc2d92efdf4689a6d62006469116ace6ecf1477047f63ce6489e7d137c1d36b997

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
698824be581027da50840a2fa31d0de6

SHA1
93677e06b50b473e9d460e860308ac585cf322ce

SHA256
e226d990b754a5cd53343897603e25a17bceb259c249f0a209242fb00ffddb5e

SHA512
56be2aed319cf2b43979d8d8f37ddb789ce368223b40faee6cb7c025f6e31dab30d045ef7b1c2c5a3cc2446bebb86f4041672322f628512e99bb619061537fd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f17bdf19a994179c5bdf4b18eafc5df5

SHA1
edbaf56e713cd1bb3d56c6fe7057c8fd1cd964b5

SHA256
10764fbe43ef24f453112b7fdb30b187985b63f31278a652fb48795461ef402e

SHA512
d369aba0c047aa308ecf12ca99ea5e46ae82f8d5a98bfce6cf99886f657d200c1e60f2f5a76aa806e79359ce815d2cbadcf1a81d34d55bb694e8d459be286d95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0bbf61d2cfe13566dc42e5ecf7d0c91

SHA1
d1803c97fbac6d0072a9dbf90972f5f03cfd5dba

SHA256
5df3187a71b28f08d100ce56b9c8fc9aff2d108f826526bbdd3f23a192398d30

SHA512
4e3d682e9573ea815c293371d34fcbd0460e941b49f8215dae45dd68a7ac4f3507c864a7df728ba449ef06d25ba75c56d6595cd88c757194fd6e4474e019aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab10F5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D66.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit