16b1c9cb39d573cc984c1a10cdd2464d40ddaef6b715bba94b37eac0ec04ebe0

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0de9090af1e7ac8792e89c0e73ee856f.html
Size

30KB
MD5

0de9090af1e7ac8792e89c0e73ee856f
SHA1

9d7834a3da2854c0d251c6f2d349e5ec052a4dc2
SHA256

16b1c9cb39d573cc984c1a10cdd2464d40ddaef6b715bba94b37eac0ec04ebe0
SHA512

a511a31a9b0f84475921772ffa5a3810157a1a36b303c94eafee995bcecf359d44a540000fbe09923bdafe3d3ef94cc5fd2505970ad6ca87bb21c8b46a5f87de
SSDEEP

768:RD7ByBCdeRx1B0QtPpzLxN2bXLKNK7l4c/eIRHNawb0Z4ejn/rjxxV99d:RD7ByBCYRx1B0Q5pzVN2bXLKNal4c/eR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000c1107f89114f36169d88a13cf21b46a1519f41e30ac5621701dd971f72a43ce6000000000e8000000002000020000000e64663eadf0a6098c30f46434839fe2259d9b757a24ac86615af21fceb3cac7720000000e69faa29a397713e02e9034fed221b76f5527c312060f8311173c83f4a97b0f040000000c19358dfaaf7023fc5b24bce12b4e75ddeacd8cfeb7098642c1f8a49ca9a0c8e7d0d2015430c1d42f70dbe3ed12d5cc639b7a8b5172f9ced92ca090dc0d2ae09	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E00CC31-A2B4-11EE-A892-DECE4B73D784} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000005a0f0b160f809e2ecd4ce58c25d4a04b31c47c48061127b783e68221b7fa6305000000000e800000000200002000000073de5100c98ba3a177e5e179c43336085813c4ebebd4cb5e5f4f11c7723f3bd390000000cb7545f5413abcc00ec6bcae2b11681d6141a61f169af92757e4ef2a95e591c3eba8491a604f444062d953e312590fb2822e292d1fbf1bbaaedb9ed03056ccf0d42759d2874512572225ddbc577bf082fb22ac0ff114c9d5885acbf9f6d5a3a8e365c86a5e0b73b0d8328770d1543aa3c56b3184fbd295a2040045f4240c97acf6c08d41ae02d85df5be983ba84acfa7400000003d4c8fa536856d748c21c9434d4602cc5020d0829e82c4cc8f53dcc230679de5578343e72bab9542e9f16eb31c801309d43fcf5c0d75f9793b8efd48ba397c70	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c64570c136da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409622555"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2268	1992	iexplore.exe	16
PID 1992 wrote to memory of 2268	1992	iexplore.exe	16
PID 1992 wrote to memory of 2268	1992	iexplore.exe	16
PID 1992 wrote to memory of 2268	1992	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0de9090af1e7ac8792e89c0e73ee856f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dcb70eac05a4b9356abcaa4ca6360e2

SHA1
fd7c793dfb7a0013d4f09587a0eb6b50b995e9fc

SHA256
7de154cb7257c0477ac9ed080e42d6b74148e5f588c6cf9606a3ead903bcaf97

SHA512
77c3b5847e8bceb858627a29d2b1426898554fd255a9a2cd2fbfcba2598539666e668524fccdbb3e2ce5b5e67b9338e8bc436212c89fcbb5103874d6129fe935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82ae3132532399ef8d24cabaf378262e

SHA1
dc4e0c5a4748faf1c5c594f0c59ee5ac266612f1

SHA256
f974b9ff989a3c6c5edd728c8ca0aefc2cb45e7c18d13f254254c6503c83da85

SHA512
e5184d5edcde9d5251ae0f6da21b0f5cc2ed9cec599402c7ae10a30469bf058c1c5927f6c8cca789366b981fd6e0a9bf2a73096691d2bbfe2320cf755ce2686e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fb478823008bc2059f2dc1a70a3963d

SHA1
88335bdb8c064e0f8791de8c2b2ed15b5e82026f

SHA256
0c6ccb5c64cba21696dc784fd59577c2f80701a41217b7fbd50524f42bc32313

SHA512
20563d317129a116e9328cb12af99a30ed8f28d040c1eb3d4ea1ba8b1dd52dbfdd79f1e43ed822823743743bf1a2f9e3238e04acf6940ba5a7ed30d49aa3dd17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6ba6be9dd43e4896cd7be433d016381

SHA1
3956e891fabdac7715e59f74e5cbc0c9ca811cf3

SHA256
2a6f2b803d5f777a15257e2cb998a40dda005083784782aad3c37934daa5fdee

SHA512
fd7a25d629a12542a3d5c89e883703dd0bb34699a9095e87afc7d57fd59fdd9d5b4ec9b850485b9b22624f3b83f1d79910145ff7b19fb2c7dca483b0f3008e50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
402be82768e70abf4215a4a7c45de61c

SHA1
e2698289fd3ecb3e119f12b587e6f2836d762936

SHA256
1ca089ba7837fb31e07f57e2d8b72196c1804d71393f20b432c6dafb68cb27d9

SHA512
bc09ae5c8562707d24f99831b4e6fc9815fb4cd1b4c2e218be81e8996ec4bf65fd94ef2eecdec56a5b7b10f2466511f439cab3361d506a61fcf73e5b6d77e610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45f793e49b75be7b596db934b976c94e

SHA1
a82fb75da329fd182df7982c68e57726a55063dd

SHA256
cf82ff075c5477a7a1c357ea0a0f880ca59f8187570cd3898e89661a480573dd

SHA512
b07e603e5f81729250e40e1a616a9b936f2d6d7c7670d11914c5ad3aa21ee5486d47f0991b76a9249b1b90cfed29e2f57fee3c2d52c7c6addf1382c41d6ac321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5487ac0e77d1e37f0062eeeae2695734

SHA1
f6b36e16f2aa679a25596a4508b2e153354c60fa

SHA256
50f1978bfac763cb05556b2790353b6ebd6cc92f6096002c26a2dcf64c489090

SHA512
cb263fecf397e0a19e6a35e7fe3ba70ad4a67e38367ebfc81cca2bb6028a898a7a9c423ee01497a6cee07a21352056aed49d9ccdd8b1e044a417a405620b7494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23baac04cdc6e7e32a78926e009dae4d

SHA1
0dc5fe1148a078a63bc5156b4626ba28a1d8bbe8

SHA256
e99db4e26ab0f2febb5827ad61d061a15c25fed64aa2495041ee66e78c410114

SHA512
0282126ffe22403d4301a1d0af5e0f34598d26d10e96e1680d49a2ed6a546dfdf8e36dd8305daee1bbba92aeead0de2246fef59c28e2a39d6f355d59dcda32b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf7e76e2be93c29efbb4171cc962484c

SHA1
bbe035256ea250c306602044d64094fba576f757

SHA256
b7e4a88eeab65edc132e4a8e697c6f333ba198202de1990636e7b86993b91799

SHA512
5049ef0147e0cb96db02b20be0bf51b27e30b01c2e66ff79a3e7e47efd061f34a73f292229b589bd4f33ef1d31329fa102d40a03766155c58a9ecdbb7c4a4e85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
560e3d85e8e62108da12152293d9bef9

SHA1
7e98d130cb2c59f465aa4a0d6779391d688c721d

SHA256
5b8afed69defaed0eb71658c46d446d240a2faa1ed7e18b153fc92f6078f348d

SHA512
5f860fdafc1e27f7068cbaeaf09f37f2196a8857ce129546f62063b5769291a4cbc952ef42ae0279026b8d6eefab5dad43cb27483540abab0b56d68da6477e93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af5bba353f54f4d23b2759b6add46232

SHA1
f0e1f868aa34b86161affb90c992a69439474e58

SHA256
efb0af62e89e965836fa7e81b5ca4bcfd447270e7dc8dbce6ce5ca91bcef7c31

SHA512
d504cd4378d36c930ef60997072d8abf8228514053a0c8ea38b4400e068e0b497aac84042a7a11b767bdaeb0bc9950f488fa4c0036275237e06fdd8dde5504a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a5e11214fa0c43a0e2ae689e1603763

SHA1
8470dc7657eca3d52eb15c53a934290101176572

SHA256
470c20d4960359df6de9f645e5fce82563999d7369b1001ed8e29de0bf32e330

SHA512
4b33941bd7e821fb4b5aeca9269a914ff47bc38c41b0e58dde15ce737a21785b8b33f7fbe182d8b457929d092abe02c9e726c3abe7be48d0e3406f950d793012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4f4e71171c21296259b236be82657dd

SHA1
d471fcb093a8201e0b65235f1783c1c968e3dd07

SHA256
2b73140683d657f35fb3ad947f3cd96afbba0808398c84623ffc1bc7acc2b7f0

SHA512
0f3ae59fd02ccc4c1d7295675421ef7772e2eff6859d227f264fd45b09b7e106db9254545e6787a03be81a4641a8ae0721719ff599a3028ffc152b9de2f3ed7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bae44396f71b73be879dfc5ac44cc62b

SHA1
ac59848d50eedd3f27350afb66d83a8b7e018311

SHA256
623c8a62cd29264c182c4c29fd9c5f3af4b4d06dfadc6ea3bb3d50b45b711074

SHA512
1a32e5718a7e2022433d225dfa09eab3b2d3d3b5080da138ef569cb16105b6d75954b4e5ad8ce28ba502c8d2177129a8e0aa331d6209e5ff92ce927993d77623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E324WJ9A\httpErrorPagesScripts[1]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\dnserrordiagoff[1]

Filesize
1KB

MD5
47f581b112d58eda23ea8b2e08cf0ff0

SHA1
6ec1df5eaec1439573aef0fb96dabfc953305e5b

SHA256
b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928

SHA512
187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4A1C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A3F.tmp

Filesize
27KB

MD5
1ce4ccd069f1dbff27b3c45af7eb4c93

SHA1
47ad37a450e5485859abb9f325227d4ce654d776

SHA256
6ccf9733d0161aa9e5850ba384281a0133dca060314ece592011d85fe69d2691

SHA512
c1d68434039290bd80bc5b98fb1f3b065351aab4c36b9feb0662f36577070303a6e62a7e23e931b09b37b613d5e9d8fb167eba1cd643a37463a0e628defae25d

Download Submit