db7fd5ebdc96657b19db0e09b9804fe760ddc7a200fd91a236747f1a4ecdfab9

Analysis

max time kernel
119s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11d57980dcbcd9416fe6133d7165b57c.html
Size

20KB
MD5

11d57980dcbcd9416fe6133d7165b57c
SHA1

a37d611e5d3747f852333165b15adf914a0ff7e5
SHA256

db7fd5ebdc96657b19db0e09b9804fe760ddc7a200fd91a236747f1a4ecdfab9
SHA512

b4845897d3ac730ef4c71e8b5ad4886b04811efe42071027205adb0f5c72bfb6e5129120e856563de9ac31b9407d9673157e7c6618fa731abab7c7090709b5d5
SSDEEP

192:N28v/tSFkDSal/zYPf4I85eVgv1sToRBzYbcqiwqVs6:Juy/5IO36TofOTm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D03DFE1-A346-11EE-9695-6A53A263E8F2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00ef9e25237da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409685054"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000003d64a7b0b40edb55e7f615729d305264f620b7c4f206d3e48e47d79098399f49000000000e8000000002000020000000b922856a8ac8cf579aa7e073196e034093280201bf1062ffe904925fd9e4416e90000000673f28d0225d73e35118f718e4d10ad962ad04c4726c788e38bf949f5222850e088f7c0fa22c673b4e633d73b9e3ec9a806af8bbe271f67b05117253d8214a95fff41c8ce3c37a18a643840cfa308eba3b027fd961c56ad0812db8af1d8859e543ff13a67ef9fc4afd80664ef256eed77f96bc25ced60c31a252695ddec2237d0b566584f484e9b7a62cbafe78ea9cd840000000b3c2bd5eb77cfbfc60f302eb0acc6c3c6519cab29f3ddd16b49a8040d55ecb0930cd89b6de1a1cd6b7b20c2955ad78d5ecbf6830c1bf6e86f55eceb7780d0130	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000090534ed79ab4eadf2ad951cdfe52dd7a7b77942b6cfe9ddb519f3bcff8dcd1e9000000000e800000000200002000000052cb232cb8267729c4e2299daecd596438c1054b647be4a3abd67496a756c8292000000047eb2c476b1579463004b2ea5a4c18f27f70578db1c74005603a7bc029244ea0400000002e99b04020d7803249b96fca86ad532c9f8518894bcbeb0bc33c9d6c3f76f0315310c207cdfab1cbbdfbf5f317cc9d637faedf834d4b5f7b6da1d88d681e04fb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
308	iexplore.exe
308	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 2708	308	iexplore.exe	28
PID 308 wrote to memory of 2708	308	iexplore.exe	28
PID 308 wrote to memory of 2708	308	iexplore.exe	28
PID 308 wrote to memory of 2708	308	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\11d57980dcbcd9416fe6133d7165b57c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:308 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7561377d544dc54c08e1fcf1d693b205

SHA1
ffca638590f87225ea4a2b54a7f1d84cf7ffadeb

SHA256
82271a726cd666aa7037fb9334f1703ce7198297c2fc8f30864dc469280b091f

SHA512
e61a6c8dfb570ec0ba22f7010996a93f82dde0b9f7bf9baf942be2009dc56b7652681bf558d82833dfb29e298dcf848a29ccb0a77bbff179bb9d14af8851ec10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d28b0786af71d14fde6fc63d7bc43a7a

SHA1
7026e40a8428d016c55794489cde7a2f327ba625

SHA256
c2d366e0700f9bae487aafe35a11d0335303c624487da50aafed8a8787e07633

SHA512
54dfe7ccc440ed6ecc83959b1746c8934ac665ce0a8d216d63575bdd9e1038f8e22fdfa8e2043c2bebc408fdb8c99dca02d3f1ccf1520ff76c8190c41dea2e6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3caf68f0464393c72c3b493b12f785d1

SHA1
347340578a16dc91df85bef7531e62245e02fdb3

SHA256
4370845c0e1d97c300078e41e81c1e96a7bb43da59063da9276082792cf7962d

SHA512
5dec21f1d9618d2af18767a6f0bb422a131745b9f42a15d99be6ef98907df01d1644a9fda19650370b93e604d95d7b118c8e48d931f4d895ecbcb001ad64a644

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c509fd3709269cb34786fb29b83063d

SHA1
814d8643a494b5cc8d31b8e401b05db8b3034a1f

SHA256
34f3264a2829b2a27554e806076c340bd6a453b20271c6f9fe94a92d12c0c3b7

SHA512
5c5fd465f6aa38ae76e6a00234e34a6ddaaa6f217923bc08c114851b5dafdea74973d0c2a0d2b3dd8b17041bd0c2169f268897d733373fbe19da49912bbd6e59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dd42d38824ebb3e4ff6825fbac4260d

SHA1
69befd4f4aa90dd21297192597303895ee2edc8f

SHA256
5f903de389f96eadc75bfd5f040c22332cdcbeb240b714f24364550f058ce852

SHA512
92c6449dd1a9ea2cde3e34d7eb825351cd2718cec159b4b9d1d24e0ada0242b8ad725fb9e6dc1f67506f28f40d7ca32946ae65a25488586d7c85ec0846f9b390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f78245da1305d42baad74724289acbeb

SHA1
0a74ec9ceefa5ba86ddc64e0ef437c0845e2f8a9

SHA256
05c6107a0ef5b6f73c6d0733395f318908b54050a02b6c26b3518f71d3a296e8

SHA512
2d549fc2f3f0cf65834ef3d8ee496c735953a0677b6f4797d54b6f837618f18d3990bccc15380e69a5ab9f3b6d83153bbd7e81fd4937f59d142e3e701f9543fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51f8281213cff118907846383a913ece

SHA1
ff87185ea334d44895c997107fd6a451e25f11e5

SHA256
229f1dbe7b2c75a235c8698f6c8a0d6bf7d471279515e1e8a6c117d9ab2e04d3

SHA512
bb591eaded122a036d64cbe3e1b4d642c531d8f29e8eecab44f5ddb98e9fbde05dd9571e16cea1024dfaca61e1f03d612a935490b70a274442e20d292cc78cfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bcd82a9687131197387766db667964e

SHA1
39e4d27bd0b311228c516d5d3070fe4ea61625d4

SHA256
c78739a90510304bb0ef3cd4f9ef0c2da3830148a78a9c95a6ddd37001cf5610

SHA512
6024455e18c167c36d8b3175e69970d559058f6e36e6519897443fa4a62cba1520d6c2bc11ad93e2071804cd3bd3e420927fa9ff6ed3caf444e345c666852e55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bb36e5b9a254817d6be235b27fba75e

SHA1
9ebe9fe029cf93951e7d54ce0f017a93180c711d

SHA256
5e4a55bbd2fd54c8b199c5cb5b9bc4cf512422893523a5de58cf51663497898a

SHA512
4d61595d2a2bf637fa388316b2c50adf8e0470d6e5687d6e6ae2213098fb8392a683c3cc6104b5a899f1415b2ccec364abc360597ea0c1f74c1eb90a8d3d9193

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a05996df3d3ae162d7ea6622d9f9ca0b

SHA1
d2ae49755eb689e313e524eb165d5f3e9da020a5

SHA256
f80152f3e344f75b5b0c124609f55df0dbb312e5d26a30b519bfb259331c3e66

SHA512
e24f1a6008dda6ca1677d2de1d6eb99d48a20def7b5f1c5f8430ef63f73c26b0ca5f53e5e96bc2cf8df5879b4323384c5f189f93f59b6f87c170b19898899aea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ddcb5211461327bc1729191f091742c

SHA1
93a34c88fa3469818129a25b71d0191b0bb72d0a

SHA256
55cf002ca4f79cabe70ccd6b57cae504fa8211aa16172585050a97de9b270c3c

SHA512
bc02b1e0d2fb7b1dac418d149e348b5f330770937bea6b8b46791b9066e5f0c14f861788df7ea409f4e45e758a7a3a51b5a19096df6c60644b72f9d47081aec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab657A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A5D.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit