b0a6bbc73db71d9e8fabe6e67f71c8043af706fbfebe766466b75458462b462b

Analysis

max time kernel
0s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ff76b783ca26bb4c23de39696d00b2a.html
Size

30KB
MD5

0ff76b783ca26bb4c23de39696d00b2a
SHA1

d2f92ffbf8ecba096c3d3125bd498248109d43bb
SHA256

b0a6bbc73db71d9e8fabe6e67f71c8043af706fbfebe766466b75458462b462b
SHA512

636f2f54469a55cda38521b617dd677688ff3b407863d4914ff328676a4a17249c8f5b77ea3ef919845c60ee30997962c50ed4368a3401ab98bdafbd7f3adc0a
SSDEEP

384:58zPOB1uK0Ro/8MxbrI/1cEZG8r73a0zqSYKlu6jOcZBjOqCWjORdIjOPajO0vBX:5UGBVitluaZQJLGHpeMLqZw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1581F361-A2BE-11EE-930F-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1752	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1752	iexplore.exe
1752	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2264	1752	iexplore.exe	28
PID 1752 wrote to memory of 2264	1752	iexplore.exe	28
PID 1752 wrote to memory of 2264	1752	iexplore.exe	28
PID 1752 wrote to memory of 2264	1752	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ff76b783ca26bb4c23de39696d00b2a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cd2ba5eab6115ef86b6b348e4d185bd

SHA1
d0b5c6f758c045d4a3fcfa49845813e9668c0f0d

SHA256
4ee3bc661bb5632e1b616b3382918d8faad9689806a60c5899b2b5fa435578e5

SHA512
941654ba96b894fc1976135966495e676e84bc28299f28b5c329be74aef981f4c3bda755dd493599f7fb37c7e861af275d99a79b84624dec9cf4159051346657

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3357737548eb8d82adf6146a627febcc

SHA1
3e5233022157cc6e170868677c72aab0647d0f96

SHA256
a93f5b0c5d5f413a30e3390440faa7b3f4476bf0ea6f07a95ba592a453ec4146

SHA512
fd5a6cf1d68aaf8e589f36ffb17fb2d171f285c7fe9d27cf8027a0d6db01625ef9b5ed5212745ed1ebdb22390c077cd5ee83e8281e0a1f695bcaec4c51d76ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a110ce75596de5909a681e1ef0ed9b0

SHA1
15c724a88345060febfa87d3420f42241b9205e7

SHA256
97834ebfb8fe707662d6040cc4e520bfa78beefb68e7b8da3a6abc29756f57cf

SHA512
11d2c4a968664162c6fde49c8a5756003ae1435baea490928a573ed036ee54c5f9f3bbd30f9ca705b0d1542064e9845c47dde9400618348d638f81e1567e9dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9f3c2fe9a68b619ace1339656aa4975

SHA1
019c7e74be8c5a7836211669ff117e8ed070da75

SHA256
8607b0b109b967c8b5a87ea197b0c6ed6623a6c38b8a528c997802d4174a7b97

SHA512
45aaf68e4df39ea05de1f28070c6621434dc5dc6d265e7ebc944c521619a3dad9d8e64ad58b77064e3acfa395ece0b09747f6c3dad31c62311619d8f933b58ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d70e4009723d738783f4e4afb22eea9

SHA1
dce64fe5c65057492f95e77d7bb68ce597855cdc

SHA256
4c067a41d136ce90e937200ba444ad89eab0a04075f1ee7b2acb14932e43d578

SHA512
d59fcee617f3e0cf4e9b568cf2bc89e5d510d4f047527108e56a646e2d395baac341f03a8d1c09778618f771dfdd338e4c115235afabe8201fc7919ec1a1fc6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
babd1bc48a6a62ae71f8f7b228f5fb88

SHA1
0729c7315349432dbcdf77734a14dde44164e8aa

SHA256
137a9388517f96f927cd52fbd19c46bd8a721a5862d0959ac0eed991aff63657

SHA512
bc3f7adc0c45c29045e1c6079b3f137cf2ad078121eae67f5383729dc5dcc990a3dd43374ee9d579faf9656a20a2e273ff97c1d30f9a3d3b266094641a4121b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa2964c6966bd9293f6ba4300dead6e1

SHA1
0886d6142b8f20a4d3c1420f5223646a73c5e1ed

SHA256
a7cf0e3038e2781d4b197b6a690368c3cf311d2f5b602197f6fce33289f480f2

SHA512
d0c521b9b2a07d1e30957ef24dd3016c25a2780b4ff4b5b69f8033fd68e70d78978b6f304c95e420530e87a987151d9bae01bfb2be0ae4ce39f6d76da31eec60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0304aaee175e022ff5db76b34bc82d11

SHA1
28b6f6154407a0e415cfa81596d91a779cffe9c0

SHA256
dbee3f9e6d3319cd478127b7e6cf326f0e7062cc3c7b618a7a150d1d3add14b5

SHA512
21d7d76579f88cd415e712b0d05d41cdae9d20dc366f7723ddb78ccb59008b0115956032bee25ad785fc21790564bccfb27174544b6fb459a621ce0ae3777d9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
369450a43f5d645eed3e1485d78b09b5

SHA1
b2add1cd31f3aa886445371128437938a51a71e1

SHA256
e4af2e5c469e64147e361c8ff21f97e3d33bd709b1796c93764b44804f22e762

SHA512
3ebc04e4f2fab5827d24d398f6d965cc260f8014de044f1440be3064c82d51b2981a0a4768e312c89708b483795bfbfba1ea6d46a354fd9d8815d7fe7f3838ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab24A3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar24A5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit