6ad8e8f9d90e0897f03d3b15a832ba095e91dd8ed65a9e2892e25f67bd67f68d

Analysis

max time kernel
117s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12e9a5930483d491e5af5a0167864e81.html
Size

45KB
MD5

12e9a5930483d491e5af5a0167864e81
SHA1

c1f7ed4a658b52e56a114d5cab575996319df292
SHA256

6ad8e8f9d90e0897f03d3b15a832ba095e91dd8ed65a9e2892e25f67bd67f68d
SHA512

776b05fc1b42353270ed85aa6d5485621e65acf1964d56f38fcfb05c950f64ef3968dc3f434c8e1c589f416cf04d6621bc48ea602f1fb435c88f8f4c3b98aa7b
SSDEEP

384:iZmMqGi9GDGWyGZGFG7YGxYGxYG2YGvvGkgGPGjiG0e3GRG5nE:iUh96qsiyYmYmYJYsvPgKoixe3OYE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{785E7BA1-A2CF-11EE-BF73-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0510f4fdc36da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000c71a40f271ce5b7ed5d742aa140f3877343b9f3566e4cf65293968e7073fd376000000000e800000000200002000000059ddf3cd38b9c222b29c6968dcbc26c5f6b3b7e8fc7851bf3f4159e41f832fd820000000ef8fb76ccd6ff015e3861424545998c569bf3b419f3ff7642e38e39d98db97fa40000000b326fc13f5b8b7da6278bf90a4dc66afcd9859d2ee012869ef72bce11a910bc27a8b0859d1163f54594366e7b473823dfde8fc722d1d077055648d41aad4b335	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000be4223a7478562a8f67b1748bf2e12af7713e003fd38edb390cf8510bd7381aa000000000e80000000020000200000002d4242865de2c35bb4fbf0b0b234a8e6e7c9ee9052b1456d51684d6a2a024f009000000059523bacb6daea3c370db73a862a678319cf33e493cff0ce5514a81765b72ef299498cacf50ad4252807d1bf0556c0b4cdebbc29250599044158970c71ed948dcbb132b5e44755416666fe06e9f493b25289eaeccb9749262e804676a6b705351b40c58fc128613ced84098748ed4099886047e614cf8ac8e0ca67e5eb1f2e0fed469af9465517fbf175a7e327856b3b4000000000b6d92e2b86dd85647483a55a403de4ff14f886cc92647e1afa4f26ce45f4d138c8a3300781e5e5da8d6c6856d17a23196901b3fbda94bac8740b4661cb1420	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409634123"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1424	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1424	iexplore.exe
1424	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 2388	1424	iexplore.exe	16
PID 1424 wrote to memory of 2388	1424	iexplore.exe	16
PID 1424 wrote to memory of 2388	1424	iexplore.exe	16
PID 1424 wrote to memory of 2388	1424	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12e9a5930483d491e5af5a0167864e81.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89cb18423fcd608f68d95a10b6f29d8b

SHA1
28430645d90b9f7d690c593f9ef493e512cf35f1

SHA256
1323f204c76b4df34df60f32fbdae6b503d25782c117e5f305253a3f846b1974

SHA512
26b511ad65a50e22373b6f478e63204f36cced139857e131d20b11080c315b5d321bc1302bdc3589ce2833653e8ba7253e5de93ac1fa05b2f51195ee3c22f65d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96ad0a5fad3581724c332b6c4530165b

SHA1
002d7e75623f7015c83d8b959428b47f63b4d4b9

SHA256
231e9df20519a1432d2dd6a7b15d0cb31b526038447a1ebfd3293ab39cf3d544

SHA512
61c2b62f1c9ae9a3e16140c97b7573e7466affbacd96bfa27d39fbcd43b10a1942ebfe62222fd7d3129e2685dd1e6eceb24f97377b8fc070ec3b995bd95af0e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7317f45cd78cc62d4a85a8e9b612afa0

SHA1
dde887d5c8828fa05e22c284c09f959f5725499a

SHA256
3861f91619f6a4f8f7f8b6ce8a42b357949ed62cab1e5547f3b40e24f403c47f

SHA512
cd3e73ee98ab7913c07291240b60ddd61dc8acbeff7bedd28fa401d2f4b55d7e88f2549291ea0249ebf3a75b8e6ad317594766502eef3583ca03014e33083bc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d11e5aea89254f5556bdfc58e9efa1b0

SHA1
09d3260629672ec5969c45e32e174383b9c626a8

SHA256
69f03c8109d1e1bcdd08936cce921f75ae0953c58857ae063874b758f08b956d

SHA512
62163a76332fd97168f7931ef1842d268cdb52bba78483d4fbf5bd9462aa0e5bf9b22ce37aa5042928016860ed8ac0e3dcfd105c6ffeaf11519983fef1311147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e72492f49d59ab4dc89b0521bd9679b9

SHA1
2178efcde565cc7a5fdc171ebfe593364bfe7db0

SHA256
256aed89a18358a3f1f7cfac1a7a54d08230b8c2db9ba7f3fc6c15d201b2b311

SHA512
7477788ed78c0b9c500cd5645c00c32c82793beec5dc3da7f1e37879a6db4e24f1d59a90a3864d07d21d390f858a6bc070ea98a5e77a94ff1c9f62dfbc9ff82e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fbd0c03eb264653729a1a2c5cf01909

SHA1
44e2cfbeb47ae0a25fcbbde1ce54b3dda2ef2eec

SHA256
64761b198534514ac8423c566315c5e9bcb74aa45818a0f5d632f5908f25675b

SHA512
cdca2efc840470566a3c1547bc1775be9d6aa6bc688c377d0c49c2a0c80ea9a090dcc8f9f5b044b316a004d4cef125d4d45af73c99142f1b2561914f50cbc12b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80bbacf10971ceb48a0081bd4e449892

SHA1
36b3bd4704bd6ec65ae44514170927a13d9506f9

SHA256
4172c8d24f61a70bb25dfdd630a07c2305edc8959c7cf05aa19ffc09d8a286a3

SHA512
39089eee58149d94267b7173db661034a1f425ef146e6bb2475d41a5d1d0aad15f7a99859b46db03182033a87c6892eb6958439013fb31b47749c83d192d8e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0115aa01e6c9547815e019284703185

SHA1
ceae2543e45ec51b75ad6adcb1aefa1d61680b81

SHA256
6136678325010c1f7dd62706c3d652947aaf06b4445d1f314ec00824d053e824

SHA512
e0cbc1f5e8c18ffa896e07576ed32b066d035c80d022ebcd076cf7b61ad2e05c5d23539af967468bdaf4dae927b5ae65206d13375018d7bad114f5a6934a0d30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96d52c962cd447fe9c3fdde2c548a4ac

SHA1
748da6aff46712cc3da8612570b96fc7c481b107

SHA256
19a3ad3e4c738ed1df6d35bb38985a7534d259bc7503f24d87f752bdbf910a12

SHA512
b9fc9f44f31535b66df7ccef3243f9cd75ef9f62bcb95f77faf83963994c90b93d50726fc37bc6d70cdf21fb7aebab78d344c29e68ff4de005da277811b8c0ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63d5140e8832ee2acdab528b3a1deea9

SHA1
c823020d9cfe1703753638fe425a127bd7b1cb82

SHA256
ba624747937f9361aea8ac975c6793b68ef1fa2a659465a10d20d0659849e88a

SHA512
0bfc4088a5d552cd294618d133e04c8c4e4d47290327db6cae5c3d31b21d8d1d5f3aa55bc8eb9140d2515d55286e912ac9e5c676bb05e3e43a780164b08ed641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a2428f8cec99b3e830d44c63e009f88

SHA1
ddabf4aac19d9bf9239484a7364adada36565a6a

SHA256
6a3fd25b274bd670f46684c280562c14db5df7c244f7a81a513adaccf184db48

SHA512
5d0aaeb3f57e2883756c6e567fff5ce5b3d8f0cf332ca0e3a30137835583be2d4abf8d57268814b5f9ca8b4c33097ccebf7f870a2ba8861a40779fda032788c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8d3cecb9b739e32576e314132844e5a

SHA1
3d0a73bbe1db4f99129b86af171d31765eaa89cc

SHA256
de82a0c087b7313f71dd9a980cafad1331c1fc3c5b2c328095fe0497e5e7c4c1

SHA512
9c183e2eb85cfed2720d8fa8bd3f1363cb88bfaead7e4987aa86bd9136446c8c3c94fd8cdaf2237b5f710c31a5c834444e1b96a726179592122d794fe894091c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab62AC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar62CE.tmp

Filesize
58KB

MD5
bee04b5fc9093fbb45e610d943497373

SHA1
28e2302d73643249ca9b4f873b56bfc5d8baecbc

SHA256
1ece1dde74dc76eddaffa6fb68b30bdb6f4bfb26a7ac0b07a0c63d7637510c35

SHA512
593641ce5f6cd4af4340ef9728e5f3792dde08404b54fdf734c3fa776a15aa29efb757b49a9f2b767a62bb1991f6e489aa59abe7cf1c7beba4990502fc84e030

Download Submit