fdd06ef6e7ee8532281b8fe83e976df618192e01723f86eab6a1ed37eb188e3d

Analysis

max time kernel
117s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11de73f534a6dc27ac54119a20f73996.html
Size

27KB
MD5

11de73f534a6dc27ac54119a20f73996
SHA1

fafae65aaae8e494bf0a9a4bbab5aa246d261708
SHA256

fdd06ef6e7ee8532281b8fe83e976df618192e01723f86eab6a1ed37eb188e3d
SHA512

c92355d4c103f7561df8222472cf7676560b0a8e6c0a36aa6510386d7ffeb48936369e43853d5197d8b44d7a23fcef2f1a86918e62bbfa6761df7ce868db791c
SSDEEP

384:E9CCDCyE0YfxD7arebuCxoBoyMLrHCfzrp38GYj:EMECyEPxVbuCxoBICfzrO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0ADB951-A346-11EE-AFC4-6E556AB52A45} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409685293"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80afc0945337da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000003a879782448340e45413383ba44d00012adeb45353499929cae45aafec536b6000000000e80000000020000200000005925eb07255623bd7c2d051babcbe5ac978d82c175742b6b27bb51739fc2e6a420000000e1b28e5fc0cc7a36e7a283134dfc257b252bd9fbda5b3bea9db130fc9454a3a540000000fa3524c2e9ef94030edc83c4703799093869462e4fd84161f7bad8f5f223ecf7a5b7c5504bc8b28faa515c514f36891f76d8e071fe7c39ed5debce4691da1af6	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000f25f3260fa99b7ca25a38f2a817dd380efe69fa732a826a396c105676bbb2ac3000000000e80000000020000200000004df55e141518d33a1a6e1c3ce66889d7ce2804f735494f7a0ab42fbb2f048c0390000000db51a353e400268f0c29c9edbf147f23d507810db44a37d6603307fe2a73e3c4d09e83fe042c5d8b0fb280f649fd4e55763665957fce78d82cd1e936ef903a5ae932c5831126413f4c0b9675009527d4866a40ba07fbe0391df98f3ba63489f10da35ceef103d306769473bb441bb6ecc2a99b2ef227bb55acdce06b67b3d5a35e9018a3cc8305271df88a21d1a85dc540000000f892ed445995fac4c2f3f9552e84e8555a1a42c6f6166c6e89fdb0f2f45d341eb9d6d11ad15de3032984240d8c1a15db71c40d8cbe0e915e8270d385a23712c6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2700	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2516	iexplore.exe
2516	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2700	2516	iexplore.exe	28
PID 2516 wrote to memory of 2700	2516	iexplore.exe	28
PID 2516 wrote to memory of 2700	2516	iexplore.exe	28
PID 2516 wrote to memory of 2700	2516	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\11de73f534a6dc27ac54119a20f73996.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80b5650e836e71f5c0c386a6c852c43a

SHA1
608c15d52618218fd3ed99f583286a63e50a59ae

SHA256
6bfc5211b6cd2b7fa20e525ae7733f5bbb991bf055f3f634363e0a57a5654699

SHA512
d28fd3271773c37debfb9b988e028f5d590724ef5d0e65508b650682b4d587a0cf7dfcf72391100aea8b9a8c4c77f6480121e9ebd39a828e8a8f4a6ea2b302a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b62553e2c74d99787db64df2a058c337

SHA1
be134bde6df8aace5964be36964b0d21fe4f9419

SHA256
9a52fe09a61bd7910f753996f9f34a985f6b78cbc9b103b12bad1825be472289

SHA512
814f568f701671ca7a697f4c1f395989212bfe5f442c5dba618fc2a2705a10dc3a47bda48079e9de9422d6af91e7c7f903a695195718280c162379e0a62dc650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9208ddb4b461fe24d9979ed1eb795167

SHA1
d7924e6ee2866182a2f679f0a107e5f94fcd893e

SHA256
dc0bda1a9d6438eed4b10ef4e8ccc2198ec96b817c14c8ad3d442d08b75d13fe

SHA512
81f1f897dc4c5effe6d750b4786b9e52289b740d13b5d492d5313d025615d5e46943da683f4593bc69413a74f3345fda94add960813a1b6b97722abdb218d851

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3c5e367e82f0badb785876d928aa553

SHA1
5a7fccc2fa4e115060ce3aa1381ec6c7853c5e4d

SHA256
1271eca6e50caff5a3dc1da92ad53e4ef4dbb179db1373126a9c7e0afaa05c45

SHA512
9a4da92d408297592105943dc1626e10ef07d59032142f945e4f379c2c830bec6467b9256cb059f40cfe527d3df0ed2565c2a9eb43fb76349315156b96f52a47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acd0ff0dd2ff439afc6a6a3a4b2e5128

SHA1
378fda5a12336131ebe7532b5407dea5179c53d3

SHA256
b74bad0a18b06f0c625ec5b85daf9adca7ba12900287e14c84f2af0aa0445d05

SHA512
bf04abb0ab4d2de30b022f580bc4245cd257f932c4664e6700fe907ea45414bd9591c5138c8c37ff5987207d2d384d5b9b66a1bc97deff1f01e419cae980ee18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9079c106978d5bd3465a96ce281285b0

SHA1
a55819c82d9347f7455b0a7d90bec4fccd58d596

SHA256
02c5ddce2906d86cf47d005fc27c776f4b4f3d9842f949e38432067c50533c8b

SHA512
4c56e763c35bd5435581f331fac52db6bbf34dcf8e3ff253d1dbd1e4d4a0f9a94473b7a6e2705f505e79a87efc1c1a248cbb8c55dace5b4436a1f738df2a4929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6505628a0884d2082d9793b0e8efc6c6

SHA1
755e78d72687988bdf987d79ffbbc9378fd97acc

SHA256
8385bba4e92433a1ff3c1100bd4bb29cbd37b1c2949f7ec36c82cfd9085d8901

SHA512
c13e5bafd2e4350c536569c95e4ebe6b6133b420670ee5f4fdcd9acd30197d9f62030d040c0316b0e3cfc38afca4b90671929ceea2bdb09eef0d8a889ce27ce2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ff50f198f110cd4c7bfb5f009ceddb9

SHA1
a6c4ed2924161442c1de520b47fb692b35169e7d

SHA256
537652f61f0eda5c1e38d2b5ee1d4ab344fb5cb703059e0ea7447c44073d7a38

SHA512
f98dcb70c87cfa5b22bbe5adbaee656bba0b51dba194290c5b9584a7934760bc221ce9021e31c15876a24eecf0d79472153d4d3fde09cca98964b35d2eb7bdd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\05ZIV8W0\alert-window[1].js

Filesize
177KB

MD5
a9ce15ddcee0777d9a954c86740dafb0

SHA1
5333b81222b4cc2a8f28a2e1200aaf471ebadd81

SHA256
fd1e2269ea1412f455f1af359997116889a945f47e38176fdb80ee906b899f20

SHA512
c2e023c6fe5a9632c8aca5ce0d3f86a891dca0d8b66100493c7ffda7cfb6baea79f717191e43febb1a055b1a620d9c22d60b3d5a52286f8f450350686006fc87

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAAC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB3B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit