7a99cd990fcb38a37807651d7d59392e5829dc498bb314abb02e304db6396cce

Analysis

max time kernel
171s
max time network
168s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44213b95a2ddb986213314c59bd8edc4.html
Size

31KB
MD5

44213b95a2ddb986213314c59bd8edc4
SHA1

e19151b124d86c7b5588dd6bba5d06c972bd338d
SHA256

7a99cd990fcb38a37807651d7d59392e5829dc498bb314abb02e304db6396cce
SHA512

96120996dd8578cc984218ba01c2a85e6efad1a21bcaa9409c515b06f3771e99c4309cbb09ba8622a099bac762a58b657e4fa78b3672338467d5579c202488a5
SSDEEP

384:SM7Ak4KweZ3lf4/F+AykKeIz/lKDG+82aQDjAeR:SMsk4KweZs+AykKeIz/lKDG+82aQDjAK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E9254840-A929-11EE-99E5-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a4b0d6363dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410332669"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000314776e4b3f004f43ff2dd36873acc5f006f25e6d8c7320877e8d39dcb1f0f78000000000e8000000002000020000000dd3baccc91c0160c14c4b846c1fc50a377ef1a3a4ae201a530d29a0e7b45e448200000003fb973244c09eb24c54227d6d397f715beb19a2be67c863ec3be0d58736da0c14000000039c35cbacbbc4d9026191edd65d9fe7de5ac68e2310ec9e0aabd517041c807c66edceab65316c1cd2d09361b948e4a6a41c0c07a29b52e2af879132540f7adf4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000359e043a623d826bb27247794d295640f215628e6887c4b210d689e64f27aced000000000e80000000020000200000007f911d6a15b9abcf86635eef784219acf692873d47145b6594cda8b059982b3d9000000064e2c47da3822ebbc8ad0e336b12005430495d411afdac5c2ee484c30d8afd398361cdfb8e2c21d944d52f6b002f6b6b38f500055e563be490680e3274752c5d5e34acf4f50668f06e9b1500d425c8ce0e7b28d22b8317378e00877d316565e6b924b03cd10366f8096bdef0ff1fc710d903f6cd986e179825c876b0d2c60a5189b5688ffbc8ff0b392081fe2c53a7ed40000000ea4773b11a00822d5e9fa5c899a02e1dd6c701c84fc186cab10502c8c8b1f9e2ded4a1373489571d8ca011c916270a455dae28774d7ea89e7c7ddf7cdd761932	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2784	2204	iexplore.exe	28
PID 2204 wrote to memory of 2784	2204	iexplore.exe	28
PID 2204 wrote to memory of 2784	2204	iexplore.exe	28
PID 2204 wrote to memory of 2784	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44213b95a2ddb986213314c59bd8edc4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3db2bb989444a6d1108ab47c876d33e7

SHA1
a2d6512b07db00011394bb7bed0801afca9c5a80

SHA256
ad93ca345e773ffa4ee76a4df549bacd4af0eeaedc76d5ff1e3f81d6e3c67ec5

SHA512
0f53e43063efd52f6a8a0ca5d4a65da4c59032de2cb5c57acb4905308222ac50bdc9aa42488b9d1b85a9d2bb6bf05e9264918243a6928078f0118f2b976008a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84034920d6d5c6ea2d2badd079ae1a1b

SHA1
da1683919c5cd4c4bc4096c0463574bb47bc4bac

SHA256
a91d3bb14ea0c6a807c15446bf5781a50b6469c113f77ee1e501fea5fda68e75

SHA512
002be5525d5f8907ab9831d06424a2cd9c3f891fc127e3926a3531a0b46a5f543b6d5e0e04e8fd257e1f0fd31bad0a4b773820b887b805858c32935886eb7952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a6c75e367ce217a9f9dd65623fb3931

SHA1
a877a919d5d6afb26060cecbfc4e2507a66f4c49

SHA256
0dd9f15bcb1007302a764373ce067712592153a023d5844c0d4860a2d759f518

SHA512
8db6294687b2b7a53a1094aea5d89e4969926edad5ea0c2f124202c2b7c48679f1b03cf19ea0f20466dbd9ba06998a6c32ec150d5dca18cab44ef2bf3ba65a76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
934719d16c3f32accba5f26267c87733

SHA1
9f80fbfd3e1b49cbaffc9d482d384e0772dfeba9

SHA256
90ab1ae023b65e47dbc2d3c8084e0b404d7348a7d9b490a51ed8416767329c8a

SHA512
ec2e44f5388bad070b77aa892334497c3b235989113e67330c711ae55f16fa26cfb46f1d569c068d5d3718a0d4153bb07721602a2e2245de477d9f9c0886035d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cb52b061220772e929c0899232255de

SHA1
4a8687d3bfa58032d9f1dbcca10ab761d885e08d

SHA256
705627469f76307cac3f30cda8c8b880ebc116072e78b90dfa2a7bf7f456378d

SHA512
42eb579249e4328d2581ef274c23260c070c6ae00e1b139d576abe96d27cbae9ce6b33d7fb7046fcac16252736a476052ea3021303819fd20442690380eb0908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2953c7f567b469f732a344cab0ab99e0

SHA1
e77d15cb644f1c71feef9b6bbcb06cc43ab0111f

SHA256
fb25033a9a31838523380c9b514defaba00421ab86206b200e46ed84aceacee2

SHA512
21dd1af48b8f6939fef09321923a5be741a14ad7d8a90d27166ed3fd07d0cd42278acf11881d9b972ed8e344961f8617065248155039b22142f64e8973a79a14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
904c7acddcf8bee7f4be93cb5a3014bf

SHA1
d9db12868fb0afc11ec2c06f2d8a45ba1698725f

SHA256
78d22dcb6f621b06395f9b0d8252a04472ba447a609f29f9b9808368d6cc7dfb

SHA512
9d95206297856a52298ec54e7134e6b749a813e9005f6d887659f9caad16ebac8c6a96fab0100d5f7743e3eb9636d02f86a5a23df9aa8df7eea8a8636823b3b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26af43df4704414c5f41af4418523610

SHA1
bfa81b56e31cd7dc746eb170b2633bb32ea4e030

SHA256
4c2834dd0b4f6cd453698e963cb373dd68f82a728522090b1aa87fd471d1324f

SHA512
842564b997c0b2407458327a170b14ff114e74ab0fc9f4194ab143665829f051a948428706a47560996af3065b9408c21b0bac8752842f5befc02870af41ca7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba4223c92ff6f7a45d4a84906307a7c0

SHA1
1682ee516286da71b8e48ffad936a581094febee

SHA256
b42e0a3001d3c24c8978ce58a0208dff447ee2a4ec282bc192abafad293d1f99

SHA512
44591f641a83e3f3fb4f96054b1fa7ccc0d42ebeaa008468d8c5f19bad7e0a158661414a6977a4bd7a5a24d5b5b868dc2fb2c894de7be3e15183ccd2cd8192e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
229cb3aeef4804a050c6adc92c91ba0e

SHA1
b5e11fcef6e7e73870728e728fd4b32337cf1b25

SHA256
294e47ec8df9d43b8449d4bd3b958382c67160498ed5ece58e5c440e829b9b0f

SHA512
f5f3e62ad8844bc7c1d854f4b7527bd4e0e9aa3d030c4064a5f7f453a879d809ffe3c56451362e03b770793b8c9d435d426a40e1eac323abe8aba17411089f8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab91F4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB33F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit