e78d8329b3223b29f48f4ba18e0ea3d93bfe7315d0e4817c7438cd2edd1ae969

Analysis

max time kernel
141s
max time network
160s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ab30ef2ca6bc3cdce9e0f534e82e55c.html
Size

36KB
MD5

0ab30ef2ca6bc3cdce9e0f534e82e55c
SHA1

cfc240290453065a5d282e5308c1193229e3269a
SHA256

e78d8329b3223b29f48f4ba18e0ea3d93bfe7315d0e4817c7438cd2edd1ae969
SHA512

3f1d38a4f85626b4a22c1aea5fc57b7198b02af231958f1f16c0657bebd5ae8703abb2f00fedc5085e89748eaa2e0640fb1ab17bdf67c3b7b001fbe857241053
SSDEEP

768:SvS5s/qGJqGZ2wQzR5OkmKJZH2JaGRXamidaGnEmehH2csw:SvSm/zJzZ2wQzR8kFZWJRigGEFhH2csw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807c2a94af36da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000c40041229b58c652be1cfb87822d4f30501bd8a44e38c6fe0ffa54d7af5f7e43000000000e8000000002000020000000076bfbe085ce41698c355ce854093bd942e3d8a7f43a57a876be8d9c596b7159900000003c864bc3b9dba3b6db7613284bfeb22ec160d5eda0ddca43a7cb74fbf98ead7bed0baa8d6995565099bad0c12015d11848d8740d57d42c4d8baaa682bd8df1624aeadcaa4eca186ca016563e39f59f403dbcc9038e4ca319f2ffbab847d77b412c0f27317f46caf96d4deed78e15c4dbd8f39086acb05773cbdd8a39cd32b80e757dddc9e1002caffed6f0bf2e97404140000000409ff8e28de7f0ac4330f168cb310624c5e4f299562881f5279d6ee2605372374388a51360cae07bd32555b63dde4a9cf9376104557a365139e77ac59fbe0ef1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD1ABD81-A2A2-11EE-A0F6-CE253106968E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000fa8fff052783172ea29ea7ea49dae6328d1383e06f83061d7e9a36a13bd299ef000000000e80000000020000200000003d4c8b6a03d93dc4fb6e454be7147078df8ace800589b43b8ae8292b96dfd21b20000000ab1d3cdeb59800a98f74c0f553e1e215e4cf70a739dcb1155e88bee4a952b1f4400000009863ed8d9df03560cee13338aace622d3ecd53b1c3c992a551a16dbacd57bab8f02eac0913bd2aecca685b974ab92e6fa4ce9b9654c0233b68fbbd66415af136	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409614908"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1684	iexplore.exe
1684	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2908	1684	iexplore.exe	28
PID 1684 wrote to memory of 2908	1684	iexplore.exe	28
PID 1684 wrote to memory of 2908	1684	iexplore.exe	28
PID 1684 wrote to memory of 2908	1684	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ab30ef2ca6bc3cdce9e0f534e82e55c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
437daac92d4d11ed1e4bf4178d3fea2a

SHA1
9266e1569c62f8e5bdd37fbc13dd86424dc6356e

SHA256
4c68e6d06ffa3eeef68c07b1c5dbae3d02e4bd048fbbec0e13125eed65f37ed9

SHA512
6a5647d1308f1f27ad43c751e1fb4a855c8fbe94ef2c02e5bbc491535a96c40b67762408acaad8ad8d82a5c7847094789e081b2af2d3a1c2cdf20756bf45c6e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e1759fd49dac241bcf5d4594c48fc23

SHA1
6897ec01893d15fd9a12b1725d89b9b6273ff600

SHA256
fe660199513ad14d1a9f8e0137797dfd2e828285fac56e96038199acf3777d5e

SHA512
cde631c4ddb9cb870e436c381e26e1956394510f602c7c282ee4702c2f3f39ebf091cdd554fe5f8bfb079740aee2f54b06610b406dd0c5410779ba659426e333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b576e40657431e1fcebe1bc53716004

SHA1
589a2cc6d63767c7234ac2e5a71f2662f0728310

SHA256
016efedca81b3e0ed1b04690ae836552843803ede09bc2ef964a7ffa31872e0c

SHA512
08d4f6a8d1824e4090caa5a8d1537114ae15d16797bb0bb7362f2f7ac8673ed38befeb525eee4588ceeba7d5978f46f895f4525ec61c2c273f3f3f484455bf5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bac92a386529dcba79e2fd5c94aa676

SHA1
2e43f349e6f188cd46b91197b9da4807fe85593d

SHA256
f1cfe581b5aefd32cf1fbce0958eff7276ffa32c1c1471193f55c565d2ee9300

SHA512
fbe01466b024ced14876969079c3bd21274d971fcf48c362d270c6f8a81e8dcbb666ec361ecda824dde275727fcc7568a62ba001dd038f9411907e6fc8cb4b9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f23c7411ebc950f99eb30e7a45057f5b

SHA1
37b7d2ba710da9b9ddd97bbc47abf423a385b828

SHA256
86343096f0337fac2d888b302b5bce747462c04721076f4542947c82a7964f94

SHA512
d6e27383b3e461210269266de977fe4c5bfd264f4588d8aa1cda70550c3ed5de33e794331cb8242438fdd25de89e7de4bac7218c81c965dc4e26a5b24d028e7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c69af70d321831d6fbc87b33bfbcb8a

SHA1
ab3fd85bf694a355775851d492cd0524c1927005

SHA256
c68c45ce5468aa6ea2b3459c3098f3b7367380183c0dbeaad7223ba27f2e98c8

SHA512
351e9601245afc27edf2bd1d79942f39d0cc4caddad6da0b4fd60e9658eab98fa43f5be0a16fee6603b8a8b3241d9a73d71c98533f44076e325dab8c9531c878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
919f509403fc5b22fd7615c2be539664

SHA1
979d4797bd28ee63802ea4648f69e8230be83441

SHA256
9dc0554fbe24549d22635933e3d6463c8f739aee4dffdbaecb657f523a26493f

SHA512
0efa2c5942d251b09313a6c8dc6cbd5489865f0d24933f744b9fc54a0297d644808d861a140b457ef0a2e3fd368d092e5d4dc22d9d58819ffff9d4ffaddc88ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
902c45e3d5ad377508a920e65865762b

SHA1
4762925e46eaa6186eaeb46107069aed4c7d24e5

SHA256
3f7783f4dbbe16872e55db04b12f01a36d08905a1d6938e772e434724ba5be95

SHA512
abf0d92f35c22195483b84d8ac21badde5de7eabebf0c77dfb36cfc49ea1be1b47dac1ef0208d3209693a6861a2bedb16e8bd6dfc24a2df02dcb03f437559caa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dcfc4590582aa39ca5f2e4e3e527dc4

SHA1
ea27d4fc80c17f3d5af74755e25f9c432d587cc2

SHA256
e35e600452437c1cc0c982ac3921476098a7e38c2434e01f2be7489e8ba50663

SHA512
8f796259dff34ea9b3ca6a719170d76512c3fb0960089f93947e17c7b0c17167da231018abfd64ebde9bb2e56e84f6f4e6925f508fb8ecc895ee2dedeb74e8b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5003103ef4b29406c55cf6ffba8bf21

SHA1
ef7e6c5f809e5a3ee531fc0bf3ddf77a38e81dc9

SHA256
3700ff1d58ddf4b603e413214da989b849d88a55c7ee1625b0b0b92414b9c952

SHA512
fa15ddbf50c0e4f8ebeb82eb1b609ffe4c0b405306c370f08aa3e1429500aed3e9ee9375d3e628157451afc2f306e0be331d1fa9eaa86f93628a2cae3c409345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adc18118f466a272886d863453745006

SHA1
905fd9e59ed8fb5900584922225e0022b48ef607

SHA256
8c12d282d69dbf514aecfb1e02d1a5e716d95c148ad872a66bd86944e6b2289b

SHA512
cd82e3d5d21d6c84bd2e027cdcf8f6d050306db7d70203ab18c282579096e1f53fdb23ec3babcf9d400f055121ca94eeff9853c9b1ccae360e0de985e643ca46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88434794bb85c7d513a7c027c92d0d2f

SHA1
24bc5336af17d9682deb510efc6f112eb1775211

SHA256
e1e9aecb33af09d79b4f5fea1f154d09524de36e91e2954414957bf9abd630a8

SHA512
ab340ae8f960c81a2919451ab12702683c497d54e73c2d31de2870cab85a2513e45232842ad23a72d9a80faf86cb130e1e7b17e5369ab7446aa65438f6970c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2e97a1956148487ae577fdf99444f52

SHA1
e8408b1f0abad32a281e12a11387ce8c6f9586b4

SHA256
6fd04fd4d55a841fa25bcc3d4c74ed089cc25c4e69e4217ea1a989cca4c4b85d

SHA512
8f0821b1dab304648c35c81ed9f6b8cd84a031e4aa1c8f2471ad2037141d5719129473478a2275028fb37cb889ad61c20a3ed432a83aaa5a9985d302fe76d766

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC219.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC2F7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit