e88483a4d470abeaae74600a19f8bbfe4b8aada03db9d65c6f46b250ea21afe7

Analysis

max time kernel
140s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a0f80b484180bc16df58f7a18ca1d86.html
Size

6KB
MD5

0a0f80b484180bc16df58f7a18ca1d86
SHA1

5f4a112dbb99df0dec7299fe64e04543d426fe4b
SHA256

e88483a4d470abeaae74600a19f8bbfe4b8aada03db9d65c6f46b250ea21afe7
SHA512

b3fb2b4951bf1785c250fb9e587e3168b524573b3aae662c38d24d7d29d375262ea92beec02a49dfb48ac661ee8024f6078847398efedfd0b250d590a389d780
SSDEEP

96:uzVs+ux79WLLY1k9o84d12ef7CSTUeIhcEZ7ru7f:csz79WAYS/Kb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000003f1b61d6dee540c66eb4f227cb8e8363bbca20916e4744aab4456b239b28d9c1000000000e800000000200002000000017f7308dba4c35ad2d16adfe17e2096b2b6b5fbe38e001726f5fc6f82f2604b6900000000d89eb40ab99667f287ad5e0e3482c619d00cde77a43ef9f5645335870ee5904b96405726b68c6b3e89c8ed9570763d740dc9adf7c99094604642465e52b1d2e1c4c72195d7a514f3a65364bc3be834332ef509e24fae3cb42ab9815d41ef1201e8fe931ad5f0b3574e6f91b5a8f96505e1387337a8be1ceb585dbdd9e6be4dd2d95bb1255f932a478585fa481e3da48400000004ff65c34c13bfb025e5add26b5d6ad474b3a7a036525c7126618e0cb8f4eb46930285e5b63762951826a8d12ea546670110a3553fc62a31385efc33c25ae5d87	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB8F19B1-A29F-11EE-8495-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000b19626da3aa527f753d8b5e64c3ca326ecd5fcb51a05f5272163f6e88036962000000000e80000000020000200000005ab358c4159a34bfcfd6c1e7102e4bd2259d5710dcaae92413b4b8e97c043b67200000005d5247ad7889548cd94b1fbb63458823885c0f1b47f24b67671dba8d17b018c440000000b956e1891350c767306802e2ace2cd2b1a958b2b8042c2973d89886ef0f4d39945e0e4c99424846592062548342380a0a00233a147062f5b9bd094d7b8b7d5f1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409613586"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10855c81ac36da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2040	iexplore.exe
2040	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2376	2040	iexplore.exe	28
PID 2040 wrote to memory of 2376	2040	iexplore.exe	28
PID 2040 wrote to memory of 2376	2040	iexplore.exe	28
PID 2040 wrote to memory of 2376	2040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a0f80b484180bc16df58f7a18ca1d86.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b93f662b5423b1c006a24552de311fc

SHA1
1d885d451dd4e40f918b30873384170ab4fd2045

SHA256
944756201d9997e173e1be70675643ffc8c3148cdd24a89c042c4b72092b1c9d

SHA512
fca711d63acf8257a09555fce025cbf6436bb9fee963fb3af05f1e38d8a0a617fc1b326eb3ae84cab5e5bb19923075445460598e082d96c814389a0b8217a1e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b756fbcff9b9ab0c616c76266f155249

SHA1
ee5ee8b9a82f1b9482c281af49d2ffaf75c627ff

SHA256
30c60e3154c22a7928f899d43c395296db13fb412fcb2fbe1cbbde19a6913c65

SHA512
c6909084272b0438a73640a64672f1e0d3fa2fd923edf235440f3ee98e7eb03e33e4504b4551a2f930b392eb0e727025d63477d46bfdbb0976cf9828f0a1c975

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b7e48a369a6eca18de5441ceb69c40b

SHA1
f18f493dfd0c7aaad1dfc1969c3cf3500fcf17b7

SHA256
50cb416e1b9ae09914f434112d70f72484c4b01755e4c90c55702d885d5397e9

SHA512
c890165f7102d03586df641950ddc5cf74568202efd513f2b9c56bb1df3c0ac1c6b40f258eddb401480a3d81a7ba4fe7abfc6d54df4b140ab2dad20bbb7faa1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1583266d4933cae0af80df24854c1871

SHA1
838b19a81985893d67dda0ecb2a5461624c8c82e

SHA256
10db4bdf3de6fa8aaadaddaae8c3c7806b009f829392f32854d96b35e46e7e83

SHA512
e96600269c464113c4c6cce6fe5d2bba0c48af5621dfcac8b7fead5a85f1945a7d673d785f65206d24d6d57a4d11d408c1f8fa33c44ecbfa6d65e587bea59999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df6eeb749322d598fa17b7234df27b24

SHA1
a25b8de19a37e4c2e1861bf98d75607e99ab5bcc

SHA256
1ba31e996c46e0d63dea8075b07ab73675e1f9c328d102618f1051f3ac744448

SHA512
c209f749f8b76ea152fd1ce7720a139a665aeafb962572597202b6be60ce9557d0aae5d431f1037d4a087e9de2837f29f60e006e639b50af73eedf3bf5d6bd51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40f340c25b0c1d146d974ff085b55d24

SHA1
02dcfc6316033d8290071ebc69db806ff632205a

SHA256
636f647a2c8a5404d370189b0a7f7ca22bb357731c158b7177cc82ec98ff8a54

SHA512
88ac2595d4a5bfd3bb498378bf19f3931367a3e9a18f28a4d0721ff60d3a73fb0828dd4dfdcd5fa59ae221d1d7b536e1f071552bde4a10b91ac0a3c1c5a2f376

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18dab0b1d2156f6d89d2e07ce3382fe4

SHA1
8f12d2459b97f242c41dda5eeb8044ff6acc7c96

SHA256
46cfb156448f961b142b420d69f0c5dd556d2dddba3e6f2261175f785047c336

SHA512
80d22af011c09d441c4c2025304f06635c9ca46136d6952dee3552f895af042cb5c572c9832e4999d604c678fcaab22f38c97e06d3233719f7ed39298fd54b4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0a546a42d5ded522fb85bf05ed6da38

SHA1
deda43a4d1d370c5fe7281476bd37fdaf1097d78

SHA256
162fecdff6a49d89ca5f0201c21c73c90d5493ebe99ae535de04340814be7f7e

SHA512
f4f1993ef7acf12d6c8cfb11b2dcc21a6136faf51506af4610050fe71e0ef53a46c01e450ee5ffd7abbe3746f190e0e78a1a420adabbb3771433ec708495ae71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61b9b6e686ce5b521051c5ef720c5d79

SHA1
1d77a43844f020ca525e5538469e7385860f7f56

SHA256
ff4c045e71299d346c3da02afb2ffcd4bbd78b26ce5659a29acdd1e562046456

SHA512
74a09a3b27dfff91285a38370c9d846930c70c21817b4ccf25309b9d399ab53819517f5892b7f854172137d7b60130896713a59596dad6ae21e8df472364125b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f90f598c57ce517534643beadcf41b8

SHA1
0480126c26f4ee3e2ee887bd4cd4770825f282ef

SHA256
355dcd3de703556b5aecd1f8e227d1d6040558c3d648c90b182df1ed1ad54e2b

SHA512
094df7f150801ba0501d612771584c0afd5a9200a817402472e532781300960684d3d1cd147931db7457c0fac1bcb1339371a4ff052a466a445265d63049f73e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e89e449e45b525bc20528da8876dce5e

SHA1
5fa5291226bbe5ee3a029510ca55e6ae1eba991b

SHA256
6912ce45791c1d65a7ba6d629bdc8ffcb3f886c9c743de1be562346ef6230303

SHA512
bf060c0e3d56fcec973e788887b571f6c6e0922fc138a27d2b33564bf92751f1798501935c7159903d41ba3ba822bd7cf3c97f378a2c9563d85b1bebf2ac01c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7424758bb460f357b5a52df2806efcc4

SHA1
594e20f99ee05b7ba5c14d6619b2b1eb3a1e2576

SHA256
82f94dbf0ee4fd6b683499e51120ef2ff2e16648527776b8f698f9a066b4386d

SHA512
07d560d2edbbcea092fa7c87f9311d5f3a54d28f76b91d8e8383d725d3c05c7c8d512bcd57f4cd09ed9cb17738210d6da59b60631f23d56155fba24ca954a070

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f8daff02dd566fd1c3ef1d24b038f87

SHA1
65cf4ba548be2027ad95f09c198e24b5d1223a54

SHA256
8e34bdbf39b7b29d796b394f2167e57d625c5477a086f5bfd53971d038373a36

SHA512
0b87a865dc518421a29db26158b19a33af70bc0e259f5c6517206c23105f6762d2618d5fa15ab9e462f96516f2801096e3b844a3f1a2c0d346cc11f3eedbe781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84cc88125feb04c4a13597c751df14de

SHA1
61f2537570f7837c1aae3559b8da96c1883a8819

SHA256
0e3e358347e227dee74b767b584d3f8b841b3fa4f137f56fc5b505b687cca6e4

SHA512
f493c5b29cd6e4b8c852e6adda8bb1819798b21eca209f5cb9b17bb48a243a6f855b350884bc2afe61536f6f17d0b1515f7391099113bb2b24205fa290396876

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8846.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8868.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit