fcbfcb1709042826570c5f6784d4fa0a689d7c8680c9a87bd75467ccc588f7a2

Analysis

max time kernel
122s
max time network
190s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10f0254d01fa86adfc7d463cb38893cc.html
Size

19KB
MD5

10f0254d01fa86adfc7d463cb38893cc
SHA1

22b1ec7de2152b3cbb897ebc35d4424ae714a681
SHA256

fcbfcb1709042826570c5f6784d4fa0a689d7c8680c9a87bd75467ccc588f7a2
SHA512

3652d202f0b63c14cae6b36fcb4f32041dc6c38be35b5e8c479c348a38d16296b07905adb708461fde0a4ebbf34d01264d5e7db7b4cdc054392d205cb34de535
SSDEEP

192:Zmg63Fr+NQlANZ65LVncW9iy2Vfw3iFX/f/A4XtkuCWfahLVQpOu:Zmt3Fr+IcW9iy2VfVQ49Ou

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e420c94837da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000003dc9c95651ee5a5628cf8e15efcd70b20a6282f0b33529895614e797ad1a74e6000000000e80000000020000200000002ce118699c41f90631dce515a25df2a787a738738a7c54f1658066b8077d64a420000000f0bb5c0a3f526029952fe928827a1210e5a1af028eed0bf53bc1f1e7e0e82690400000002f37b8ec100d0b632502f1a270e411e9e352681df1d406b52eb6718d59909f08d139995a2bbcd640ed6c83a966b01ee9e3719811c50515989fbb7fab043c83dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409680698"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED4FE451-A33B-11EE-A581-D2016227024C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000d35fc0ac67a0ce2d921f3a6d8a4dd3616d290a0834456f19f490ca02b173a97d000000000e8000000002000020000000433b5393d4b736a24f35c21fe2ef1f2b5fc7cd242947e638a82e7f457c2dbc2b90000000e2f3cf0ff05c1f018a7fc3ef039fe7388e1456b89c255ecaf47b0e290354ef6783ee543d5fdc17a33a4bd9aa58894083674fe2540424f1f65af20c009de3c1e51f10975155780da33fb173defcd29aeeb41cc9e93ec019f7efe90d3282f8f61621a6cc81ffe7214bc69032907b20b984d47dceaaa7772dd655de789ccbe433bb7659b7911fddc4392e8b12a1852c2b3740000000725fb03e3cd8162725c8f2e39fa74278e6a9e26d559b9cc8eb67faf90ab4e4e35f00f9336cc7c4a7ebd32125a4c8c3d0c0e70d6092eb2bc5f6298320288df88b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2832	3040	iexplore.exe	30
PID 3040 wrote to memory of 2832	3040	iexplore.exe	30
PID 3040 wrote to memory of 2832	3040	iexplore.exe	30
PID 3040 wrote to memory of 2832	3040	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\10f0254d01fa86adfc7d463cb38893cc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e71963e174b86d8700b1c89e47fcb02

SHA1
e9e1956741471b449402e0ae2e7eb14b80cae162

SHA256
ebc17d2c110fc12f9b61a7d0c8137d4d8365136e3a8fb4f9c0d5f29d1928dcf3

SHA512
a829fe9b5f12852752968d3a7697d343d23a4e0e2381619fbbd396a373205e4ff7d58dfdcdddd0efb6293e4fbe677b9f0302ec3a6b5fca10087bc6426967d0cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb63d79f4381c297d80aeacabf8502e1

SHA1
e3b8b48e4e01537381e25ce18289c27275aaadd4

SHA256
cb797f64f79a58cbd73c7217ed44b3f031f1f8f879de765ddbe393a485e8df3f

SHA512
ffef5e6c9366d70e990b6bef64b3a56b77ff80cc6430320f1093bcc1b09b72dbcfaf6a77a1fe92bb54727c1e7dc9c1a07bdaf486028586b551801c947bcdc9a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1ce97301ed298862150f8ce58bd6dae

SHA1
253d223d52b5c004e522972f4ae0bc7e4b399af3

SHA256
62ee9d683bd2e9f5f446915e2282abe1c25ad10febecd6e290b29223e58863fe

SHA512
f214aa6e05e6ec709a4e96c301d2f75914572642b5d98b55aa70633eaf27546997dc8bf711a3d6eb8498bd0e85c8af6c04f185d309b9fe413210acd1efac9df9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d21420900c6f6dca05ed18bdfab6562

SHA1
683e472c839ec0b044687af3fcd5144f848bdcaf

SHA256
fcb7cfd62b219b097f1384998a44695852bdd1fade9018d808dee9aa84acabf2

SHA512
69565317f8c4c5a06f47efe03305af35a55df6e096d63616f1c4a37ce434243820c9451d2df7da7d3f6c1621dae8a781bbee7073de1899dbc63ec08aedcd5eb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
790f60a1243c6e8acf77becdb0cedba2

SHA1
acbb004048b113d83692666b004e241fa0aa3f61

SHA256
09705454e6fa0c6190c7023472de606ec1ca486fd828886a6e4b86b10f57acb5

SHA512
419e0a085dd23e5bc7ce0e8ca98069c35ef31f5d3623f552dd49bcabcfc7a62cec7ca42a2c7ae44fa9e8809c4c61f100566d0471bb73845fb37547e14bef8ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8db6355fb7cc6f3983e1f99377c099a4

SHA1
f068ae93c18ea1b5edf30f5fb8c7d3c137cde7ae

SHA256
5ad71b15d8fc15af9d00c74a0a35c4b1a26ad41d553ac9c893d9fe9c43e1261b

SHA512
152aef92355e8cb1bcade2103f1ad2c730f745c671d46f827085928aff0cb7384d993ba172bb71cfcaa0ec7df2b23c3080b68ccd83e87d24d498fc4d0db8c6bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bec190b0999bc48227886c69e52acb45

SHA1
dc5acfeb3d21b178661d9941f358f1530d89996f

SHA256
4c159637ac52827c8be5496deb82c00e0d232befc66a9519150aac47db11ea9c

SHA512
f2707cb6979eed6d4daedb0ded4b3cf5b2b34ea05b52d9a6718d6a2eff14ebed1edc853f08ca051114af9dec51ef58a32d21adec0c3c622737b538c14ceb70b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37faf17867f33216d4f40035194b266a

SHA1
9f468e42a4d1ffecf834325685305eaf0e0773cd

SHA256
0a66ed2d0defb38712278268e57b5dc08b28c93eb09ac66adec20a90681ce2f6

SHA512
ad784ae1f2413946af98f2361559a223a827ecc714d1b5396ff540beff9e0c84c5f9ba7277a1c97187c127e8e4cf56af8f3aad3f5caacb187e00549d1ee5f2a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b095b4cde7771e55e7240f0af78fa223

SHA1
39ebf4bd038f752fb4f1062ae8efb047e4b14ac2

SHA256
d9e23556edc3bd405233b5cb8eba479dfa23cf9cdc52cc5a9f43ce1cecf6e39a

SHA512
9bd536f93e61f32ad6beb406289ab13bdb3eb9d5f819517c139e74f6dfb3354df1eb31140831393e4d1576d1fa0c902989055ac68f5e399daa1df25b4a949105

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4E50.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5D33.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit