e8c04217160739ab872c02127799fb103e1aa865ff33865dd85f89725abf548e

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c090d85d9a9efe0ac7f809744c533c2.html
Size

53KB
MD5

0c090d85d9a9efe0ac7f809744c533c2
SHA1

2d3eaaf7802d20eb627457febf45e4296e55be53
SHA256

e8c04217160739ab872c02127799fb103e1aa865ff33865dd85f89725abf548e
SHA512

3a915c9f9570d8f0c47dd80ddbb96337e8005a7e1880a6ebcfb33e4048da4ce9f94edbd9c2e9a2af4cfa5351ec135e77086d0a3528e06b8dc02179ddf68cda29
SSDEEP

1536:CkgUiIakTqGivi+PyUnrunlYP63Nj+q5Vy0R0w2AzTICbbWo0/t9M/dNwIUTDmD9:CkgUiIakTqGivi+PyUnrunlYP63Nj+q1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804d6649b636da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409617742"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000e3410e7784aaf93c9b0aa31ba5fbb3b12c230b96ffad5c46ca1778ee91fbb455000000000e8000000002000020000000c937bda911cd69554d6d4492172eedb9d4e934bbdbed870fdcce8136b12ee637200000006fb580e0cd0b9cb88d75e6f963803d4c512420a102bdf6bb13ac0740ba84a9f540000000f98ccc5f80d49285cbb6aae17bace2e60ebdae6527a2c241af76245313b081144c073cfca3729a9a261b61bfb37730ee8b286f59cc51c3e6fa83afc1db51348f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{569C7921-A2A9-11EE-BFFC-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000004284980765783cc73589b2a4aced4457e4ca1fd67e3707a21fdc06a0c1e7e107000000000e8000000002000020000000d1eda4fb9de7ceee3b9294834a2b35539e6412a9585fd3cc0460e52f2cb86cc390000000878168fef9b704e1ad702c2162ca61ef2b86b3542b228d1a137d1b82e4b773f2db1952d8830d284b845991d4194e5c5d1cd305e22471312376b89eef251d290a00e873d4e6d0f4ad8fa0504d801aea65cea2a3a1086a4a6e404dd980436897ce5e3eca23efbe5d574f0dc1810d730c9e14928fafa59bdaf156a72edd96b167ca17705dd1c3f41d2d700f1ab3bcba7bf240000000778dc16da7845dee3fec76599e937674704f959aabbcfce397521711c266dba692f3b14456607aa99b07fa8c499222692ed6ae763035a67ff7b82ec758938b5f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1132	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1132	iexplore.exe
1132	iexplore.exe
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1916	1132	iexplore.exe	28
PID 1132 wrote to memory of 1916	1132	iexplore.exe	28
PID 1132 wrote to memory of 1916	1132	iexplore.exe	28
PID 1132 wrote to memory of 1916	1132	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c090d85d9a9efe0ac7f809744c533c2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1132 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38db49cfd2b695c1e458d20ca2a0aa81

SHA1
30ae99bdb7045fa6ec12fa1b906160626a0aba4a

SHA256
e004a37e91a47604644cc4f23475cb99c071d4caaf30e27f4bdd65725d463916

SHA512
1de0b15015ff12b35713a8dfd5e1bebef12ca331e91c2e289258dc9b68880ffda93b53f3c9344b39278ba7f7dca19cf7f602de52a3ef2af4dfe6399d313b6d81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28e321a2d2e580f4950f26991dfddb59

SHA1
55d558b5e192cf6dc0b8b5bd3061d2b473adf8ec

SHA256
7d8d6159799bd160b37a89d81c7332d2cbbd8af00030400d8b37327611696bf1

SHA512
efb5ccda4142e052db09718dd72b1cb58e6b001463ddf4be2a3c7235e90af4ae21b941c267ed8b14a7dbe406c18648bcf7e80a27b1b5aa32fdf9bf79152d1914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c217c158016616fa1e6b3a1a9046ff99

SHA1
fd8bbd88a63930e86af25ec49fd9e2eb940d0aba

SHA256
e357c340af4b324fe56c35da0c82371ca050b2a20dedeb856133420eee2e92b4

SHA512
dbcd8d9baaab12644f7ed0050dd4dd3975914d5fe711eb152308d44079c7966d9aabc435f0dcec2eb3f402906f55f6f325699d71013e297601e04a294de2ba26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b260741452fe2c3b1b461c3f4d4c3d01

SHA1
9704ea45976b9c9c9dcd99ed5f61b7b723b6b5c0

SHA256
189e8af96d840d47374b4238ede294efeff77b4644b29d6421a562f52b15ba4b

SHA512
a8e9b9c8da041957cafc2dae422f541c1fff83beff16b0e4bec3371c0ee8a3fb048a83eb47dd4c8f24d2ce5c7e1a10d0dcd3427e981ffbea7f5e3f17c4a434d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d6a88ae48b5d98c409e0d8719760ece

SHA1
f6b71c6f9dc79266910f052138ab14e4859dc874

SHA256
7b84de99b4c65ee0eb8064e2b4bac9f46ae36a600367a658faa3f57a6ab8a130

SHA512
b1c4a00affb2a678b4e0cf75888d438fa479cf93c9df7760b2b1114dbed7a51b7454843998b027a1b42e4c83681e9093fe570a5f325671cec58df2ef54805798

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0534e2e0f6e009f05b4dd1e005f8fee

SHA1
207ee5b2a51b73a4cdf036f0822b27cae59d1873

SHA256
a56bed3c29ff624258e9c66b78edcbf5e5c7504d2327ad03abfa6a77b2cf3eb2

SHA512
f9b88f356ae51ea46a0aead198fc65432cb74652c56a40c3fdbb55bfaef04a68020ab0184c53af80868e0131fd34692832efb4afaa374e2eaf5b765ff5e9392c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3309ad5ff89c084b670590648b4325d

SHA1
24a23ba9c912b75500570179f15881e0e86ac6c2

SHA256
f5984b7f79c4d6b2c4c4b119388177fda5b4ddc0cb5ab8bda749babfe51977a1

SHA512
e2d5b0fe385b469f2f39a0957d0704a85b31dd698c4455e3d21e432337f0ceb7dfe688913fcf1d2d23977059c0e79b919c0dacd80a33750d7dfd9e9d8987f23b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dfc3c3e1c9afeae86ced0864b596d45

SHA1
c4e50ad3f4bea5125319bfc56d16117ae7c94110

SHA256
7878413cb22021bbd5efcf0e4792bdf62bea3ca24ae73a79495a54255145b59c

SHA512
8f3cab8152fea4a240f66e9e65b59490ef73d582c7ea8a19c72d2938ac714183e93fc033b541314c0cda4b6851a74c912887c9d28cc2aa772c6ff599dd020555

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec3cdfdc928f856aebedc444abcaf866

SHA1
136da8192fc4ca768a7d89b33f414fe27ea9f9a6

SHA256
f43c9542c46be23b68b91c920c8c12638f5088a5426c89c0a008ca493df98b2c

SHA512
9b1dc8c6aec68f6652a6662d918a15159ea584ab15fa76419d9cf4acb25c92ac3171f5e15ddea862ae9bd53624ba17f48efd19126659ea1021b38b381d6e241d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
305ed2487898d2dd0c87e113ad9aaddb

SHA1
2ddf0dc7dab4836e80cb6486d1db8ed81bfc817f

SHA256
c2a81cab3325f792ce787e801d4219fbe4cff1a79f7fb3f507b910a115c91328

SHA512
a9a1d48c9ef5a7824fb7f76cea772470fe559635714227e039bbc2a176508403985489bdad20d40ba8c7131fedf3e6ce67469788732094b280a9ae0351a3aacd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bb3af6e98c4442ad64d0b59c50ebad9

SHA1
68aa0aa703d20398d3736fc7b5baae9b8e133f0b

SHA256
cb1a9f09ee9d8df8059847e9b8b60aca56e2cc8549a37b8b421ae5129f80e9b9

SHA512
0d1b0758b14e4a5b97778f7ce52c0ffd8381b6d8bc9a5dc1bc1a36e1aa91f3715ac35bf9b4e1f4a120335cb396ecf5593c005811878748b51e2408772bf0320b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
035ea47e560b9ddc1d9d6a51af00af94

SHA1
2cdbd01d862acf9be775bbbbbc6ab71b749d4ef1

SHA256
1acf283d00273ba0a28d56e2ef96e028f47616b5ee220c2db79f25c22549c102

SHA512
b0b7f7be2c2c3bc3b4068e653332347ab74c4f4f2ba6ed3e3a71b64803db7f7e518a55ed906c9cad486c8be8c29f17c6c02acdbfb0ed4249f68fcf0e483e6875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8674dee774015b37bebe7e2e9bcf17d7

SHA1
df3ee3e872e316cfddebc73f62069be62b1f5c21

SHA256
252cb7ea8ab9627de9cdfac1f99b5c6ef2e3d62cc07693b1e2b1fb1e203911a5

SHA512
87f9b3dafa25ea3372b70d6d2e5f5813a3f126c204a0b1073534105bf0c573bc27580980bc710a614a4a3bf8665a46a39571c0d985b1df234dd4fba65922840a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0I6KXNQ\useroff[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD3B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1194.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit