26850277b806a3a50f7e5445be59035160cbf706e8bbde83cdedd06ab5bcefda

Analysis

max time kernel
140s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

112495f491e31db9a66dad33343b07e2.html
Size

44KB
MD5

112495f491e31db9a66dad33343b07e2
SHA1

4b43b196ca3f537c23d3d583f3d25545b6760081
SHA256

26850277b806a3a50f7e5445be59035160cbf706e8bbde83cdedd06ab5bcefda
SHA512

fb92eff350dcc415d14d75f161603ad4bf2dd9b7586ff4875f7663f5f2e8fc8c813dadda221b2258548851e408f94419cc9715bea046e5ec9d9ece0a69c7c328
SSDEEP

768:mwS0l/sGVLsk8ejW4mTNn2o3AelgmSAYgnDTk:mZJt5AelgmC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f2e56e6f4a1c5090586d3bc3e543e7c6b9a53bbc29e11a70bfceae712a7d425f000000000e8000000002000020000000542daab83ba48cc11b631ad7f112b13758e64247a600d6dcd4e59ec90ed816d020000000b4a472a181c0ae1bd733eda4e43f1be9ff1a62a4721a81430b120b6b13b8b10b40000000e35d86313789c1c893c6695992c69610972e6b0553559f2daa47f6c99362c2954bcb412de7ab2b9537a2eec4cc66bfd76b16e64f19f302f6ea1de70d819845da	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED77E431-A33D-11EE-AC0C-EAAD54D9E991} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c4dfd7b80774fe21349ee0b03b8484bd775718f73d99f70fcfcbbde7a243067c000000000e8000000002000020000000419b2bb0ed909cde2521ac3c2cc697cd475ba35a4fbe8fcdfcb1df5363d6dcbc90000000c2c161d32e193326e0f60d1937f9549ecc3bbc89bdef3bbbef54ce6cfefb76dfffe6252e2fe358727d5757d88f03e4944cce78615b5d4de41b3c0fae5de9882ed2c632bdc09cbdba63421bd30cce70748df39e928d3367e613886fa2653982ecb88bf84fdfdbc0bf147e56436c91b6353171cf498ba1b1dbe88e1a8ad2e688c3e11be7c86b398af4c8d454cfa846f216400000000788718100000d4d4e53c8c491020f6d95277d1de02c0afbe2d16d57a0d443a2958f08dad72aaea44070685b12729ec382973b79f421248a8e9129871f1024d7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409681560"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001eb7f44a37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2420	2096	iexplore.exe	28
PID 2096 wrote to memory of 2420	2096	iexplore.exe	28
PID 2096 wrote to memory of 2420	2096	iexplore.exe	28
PID 2096 wrote to memory of 2420	2096	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\112495f491e31db9a66dad33343b07e2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dbdbd79ca1f3d04a926f99ba7ace551

SHA1
3923abec0a067cb974c0ceb1d2f5ac994529715c

SHA256
abd036f476bac5600767539c1d9b6d747403153ea342882600ef0d63a2d8702c

SHA512
c1fa4b132bf594ab881f5446d3897e663b18d51e9e1d8ecddf0bf3017019f4b138b7b042c5996450b590316cd26f64bf52e13c95304955a07d7a2aaadb632639

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2fb7c7dd30adcf4b222053d6473d3c9

SHA1
753f0244e0eaf8154778402f9a7e2e282ce83c36

SHA256
b0e1ee5eac250c08ab3bd28196c2ad3809df3e53ef4937f9a80b5d5fb462c20d

SHA512
a9f40ad3ba82db5dff898734a222bfffa0f456839cc36cec014f35a563609b8de63f8df0bf94a2727722afc83c1d1562dc03b2885ca46b6882d6bcc6f5d07867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
388d3bc77a0f975be774003e16f5325f

SHA1
6c64ae3d63fda62b8c4f511dc3b5645e5d7a044c

SHA256
d6ca154eed1a72b6d53ced3d5ee19d37d0afadf87a03a6fd4e723c91a5fb2a32

SHA512
0da0164a6bea2a03f0c00b8e09569533dd22a54961ffc297fd7715c4c4c528b989148b8a7967ae9a72585dc81c60d0bedf5abd50fd3aacd1932162eca505743f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ced506b4a65f9c4bc822862587f1f8e

SHA1
56a60230494b56e21d0e7634531a93a85d5ed62e

SHA256
82d304c3636162391523a3a086ebe7f94f527730c921d2f1b04ca4f4436487fc

SHA512
1d2dcccd951284ce115d1af5aae069aaaaca1e1a7a80444aab28f85d2fb057433a507e26dbddc1fc685ac9e7ce57487e513e944ccb48bba88bc9e5fe4f48f051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
153bd361141f1a6049ba7ced5721637b

SHA1
8dc161ef248a7713a33c021cc5ec47c973f421a3

SHA256
1437392d333b3acc94a92084046cbb9c5935136b3a5eae8da7e72208307768f7

SHA512
913574693f9b1685201026de0793fd4d3ecd073cb7b8de4833b57de6e40a5cbd884fb894b14d0cdee8ece314d6db6812e0b9a48d871f590382297811b133281b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
947c5488fcda1262a3f2fcd1e237dcc3

SHA1
07c3d870d1af8cbeb9c9a422d0d881d81d3c3fb7

SHA256
50ccdbb9da325aa7ab80203d76fd98049fc99426bae8cc3c8a688f5c9feeb20e

SHA512
2f6514f0ec9b158610763c5cc82807c3aa69cc4727c97a70586a05a757c2d106258b771f6125da9d9fc9c63db274b806cc7648799cfafe6069d0ee3c1ae84ac5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4a7ba180941735ebcda74f11e539495

SHA1
fe471f5e9ce21a69f98459bc1d99218135a550ec

SHA256
f3a872a3db3fbcc790c717441118242f3cfd6951cc6cdc8e762e8a9c6d4f3a36

SHA512
0c5cbc0f42f6af350ec8a8140346aed1c0248ca084f5e3cc818d463bfd99459ce31c86e552fafcef5b6af79bb6fc05908766a5db786b9a2410cdbf36bc3d0688

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f8168d283da96bb45426cd87b13be4b

SHA1
fdb7df69531200c96f3931521b26966db12a2b26

SHA256
22a018a228dd8e9e6abf7c1ed238a9d1a26e35de353b33c3e2541647addba878

SHA512
bf8974f9631f475f8afea9223a09d8457e3b7a418e77e6b69cc126af507ec47060210a9aa96bb06c02bc968b02d44e78be54bcd1407e12d598363f0a85267a14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddca04b638ebb32fc1f77503cbbc9006

SHA1
45e25acb44a8803a6e7557ac6b6d74f083e377a3

SHA256
5a8aa5f9fdd19a4b590825ab0a09abcfb096d0a7c6dbe6a761651dce2313efa8

SHA512
f039016c9a059c5df3c3cb672c9af0d90646c764a4da0114443be6354972dd667ab7cb971c2365099f1af3457eac1aacd4f8d8f99552fc02c6b280a27cd73543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7216f88049bf0a4b2041c59cac1771a5

SHA1
7119c70532d36149545d30bb802098e61aed49f6

SHA256
b6e445e405a604f00265e254747257b369804caa211ebd673d1b6f3e3589eee6

SHA512
6762a248ff2ff3026c762300d3166bbe2ef3c3699e84f5a2c2c9b59d0b6e7b3b0ca5b43e71567f8a91db101d425d73290e1b02c2002ff87ffd69baba4eddbde1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c5c1b43a4ddcffc9700a1dce986443a

SHA1
4df44545b1dfba568499f23530f1013b44ef28d3

SHA256
d6d5d3d52421bfa8707bc6b03980bc682d260eb2fcecd66a60bae11a3debec46

SHA512
b076c6d7c5cc5b86deb8da7db073143241fe73dad1b61d3ab5b074711552cdbb59ed5b1dba7bcccc4c99a2897910732ab08bf8cf1c8fc5004cf02bbf2a2339ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c9797c26eb51e780c7c64dc583f6eaf

SHA1
0742101a80f7100f29a77fd2d204b010a58d7eb7

SHA256
a0a6c2ad51a250b5466a41566eb91a4c566201780ea17dbb1745608a83451cfb

SHA512
dc544638ec9d974d23a2029ea4cfb7d1ec8cfea9a2598c8b6b68f4e130ac587b64400bf14335cfc42e76fa8cc82808030882d6e08aa36416bbf23a0117487ab1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5514.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar594C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit