bc6d504fb10d699ab32e4a8d6c4c07f6972cc18f4cf687f97269201f87772381

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1eb9f2b87dd53be8ca55d4cd74c4a0b1.html
Size

173KB
MD5

1eb9f2b87dd53be8ca55d4cd74c4a0b1
SHA1

96ee09c3760fe8c40c8924efaab2f9fbf979bf66
SHA256

bc6d504fb10d699ab32e4a8d6c4c07f6972cc18f4cf687f97269201f87772381
SHA512

9a9a365379a4f574e452df3023f05a1859600f29239b2d59b023beaada4ff421a986ba62fec86d830f65a86f95b40469241a86016e1316cb8d49bc18cb208f69
SSDEEP

1536:nYk35y7B/8jrt4tFo1/Iw7vn6DkjeaLF+fVT:nYk3q/HD4K

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E76A5F31-A308-11EE-94C2-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409658787"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001e5cb00ffe4dac8fe3d6aec5a526cd39b17603bf1cee7c8daf663f57e6ff1e6a000000000e8000000002000020000000325b3a18a114b036add05505b654ef268a0647776c03837042dec2a6201c87e42000000038c43aacaafc8170c05e316fae0d2d8f31f2016af45781055795831f5986420b40000000fc2d979c8ee04dfb17a9ce7df6a1a830aa9467f1b2f78f6afddac92a42305b3f51533a3cdb6f300b5bcbebed780134d6266e85bf200d5cb9bb24a52ab0588a08	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d6efed1537da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000bc60c182b552e5e9c9e703d96a3f2a95e25e8609936eade008290e350a74036d000000000e8000000002000020000000634a1580a63787f856da4c786a81035b81a305c96d6fe9f61229d8d244c442d390000000ac7c76084d45c69b4ec9ccf3f32dc3e0692f57c27c605666e4b3ee2eb34d09f6c36d07febdad5ec36ba2c98c1201cbb9739aba8610fb588d3d31104432ce035cf8c8c382190c5430fd44ea36f4c2b2e547e50de09923499f67d4ffa45ee4e3cf2d81ab5ccda11154baa120ba701a6a1227cfc72d1a0d848e60d7e1fa14cbd3e49880238637cab2b14de28e17231e2ef74000000026abcbc5df76c442e7b7b48fa4ba2e874984e1bc135216a594e65a0b1302aa65dd6a0b625b5c35003c850782cf553913b9323486137b025091efa140139374b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1536	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	iexplore.exe
2988	iexplore.exe
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1536	2988	iexplore.exe	28
PID 2988 wrote to memory of 1536	2988	iexplore.exe	28
PID 2988 wrote to memory of 1536	2988	iexplore.exe	28
PID 2988 wrote to memory of 1536	2988	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1eb9f2b87dd53be8ca55d4cd74c4a0b1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fbc2a42c02e95bc01cd04635cc80c23

SHA1
f1b929495daa24b6f7f1a07f4f1b8829b708afd6

SHA256
78ea3bba660d6e59fa1d3c1fdef80e5a2ad0ba660dcc8e0028fa01fb1d4a1c1c

SHA512
b3f8672500f4231ca2d9671968bc27caf9232d85495a2286574e16b341bf813526a3094a3a10f7baf956047f78793b179d400956255591aeaa1980ab3c57fdea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a14c9dc67ca01bdef5b33253846317da

SHA1
041a6b04afef0b52563d6c28f8e6b2a35ab6756c

SHA256
a743d76b1183310bb2d199828f07c9ba9704b6fb21d0df3cb0a95b68a5c7684f

SHA512
30880c08cb3461c6603b459780d7e058c5c93b3cfd44c63a7a12d537c6abe0563eacfd5a5b9e4d31220244a9a8f7a8912104d962f689d039f749fbcf3c4cd8fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa98dafb561ee8dc35b741c2354e1259

SHA1
fc47a36f6028fa39be580efd66cb1568d09ce856

SHA256
7e4698ab27001ac1c5b394cebbeee41749470769c273332bbafc088904232d8b

SHA512
b89098e472c4ed9c975220bc25feb85d978821e7691b44ec8072c02e00555e14a7a24615c85db1d2a62597e77dd6f991fe87287c41ba5416b2a1e58d3e830618

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06e315b326a158261904e4de4394e550

SHA1
3131ed12f7cb08d3ddd9bf2d53ae659b2d458a89

SHA256
0c6d7f4631b6720149c038bc9eba776344504e43a7ceb34184a080aaee7e22e8

SHA512
2ae316c404b578589030fdd94206cbbc8e56dd222c925f1fb3ede5b925a39f7c7807a781e3e2c93576310bfc8f0ec0000b1578c59ce7ed7818f45e42f54a89e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c314a3fc19d9039fb55957e36b1ab41

SHA1
f51db542b3592282c3e01cdf1677ce2f475edfae

SHA256
d7cc9cb6b3fda1d4b8c8d0521fa85e5d9ee8722ca8c9b842e2e8a48449ee7a40

SHA512
811621e2d6dd2edf312050eb7845df1f1fda8ac69bd54d169cf356d34300c8afb53ddb0026b34bf3c0f162dcd9fe4b0d6505a43e12e5c87bc25744a523d10078

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d30ad71f7acacf0e46838c9c4d24545a

SHA1
b1475171d60f1664b541b83e3e46b6c591e6d09f

SHA256
9eacecfba8439b17f4c583758f4b9edab2037f2f33f5780c964c682d10bc498c

SHA512
453f4f6a84b0f1f7d76c740513d1e1760b41e0797f96c9dd112ddfefab82ebe779be59e67047a790cf4d9058dedc29bd1b89be67916d33a286704cf35f50ebf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2f604a464dd9001e63eb515421b52c1

SHA1
4f0a108d606e8ea5f8d57f67a6412fdb1428b018

SHA256
38c728bf40ac414b0b64738c6e4f2493c1d598f7562ab244ad0e68e7d3a01305

SHA512
8da74460265cc944d37d5d95f7e03529ecd4827d105b9e988f74f83fd49ce6530aa7056f149ce29aefbff2096246a14dc9dcc811e813346cfad381c032af8a60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
062387466478a74fb1a2103fe7f554c2

SHA1
3111272de5be06fa637ea781a7d4208bee5ca6ab

SHA256
e81a6eef37ce5304412cbff99c5af4f61bcb85ec3c08708fbd8bae4d64a517b9

SHA512
02542b89c17921fe2ce5228f86e362bcb730299fcc3dc085bd4d07c6675a2dd10f45149f2b775a0d30a9e3ac75990a5e86b51219daeb7c300a499d06269f5496

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d2a561c4d4a7335745fe3a8e355c3be

SHA1
649107c65e3bb762775ea4a4e54d4995211c011b

SHA256
5bb827e93c515376ad2b3b6ff1b699a79f78193a8b8d0c791f7cbf80cf271274

SHA512
92436f168f0561162a14c9e9dbd6cfbd5419f0e167a1dbbf3c8aa7fa4172e0cdf20d901e17b66499c271117426542a3232d54eb3845e07f3ea7d786c20c62b6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3cc8f4a11aa18544154042eaf4d5346

SHA1
1c37f23fd88e06adcccbd2fb6520e09c204f896d

SHA256
382cbb563da9eb0d53d579496e194ffbe0f63057c7f4cacd217efad41b7a84fa

SHA512
e192fe8e8559c23c7e20afe07824f012399f559c029bc5247712cc73e6381815e2c2b490b793ffaa16444ab3f4beb4999b5e64d9713d4d468563d18ffb3cf6e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3865c96a3cfa57a96d9c21deed41ad0a

SHA1
25d137ddaba8f14906855814672504b6fbd7babf

SHA256
043e9df3d0434a898d38815609985b9bc01bacebd59844b67ac2b149274e563f

SHA512
a4d8fc322d3394c81c917cb3db10449a3da0cf3550442aca61f907588d04234f66b1a72cc8a6b76e5fa0f5cbd4d35a954df025e920b50e562991cef06bc46b52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1a3d858e41644ceac7f3e54ee4d8a32

SHA1
45723e882bfb0318d4947daa5f8e3354a458cd32

SHA256
d9b854c88185aaad0172e455bd125b178ba9cb32e465da575a866485b6a0df85

SHA512
c60d20ac471bec31c3d3179e8cd264b91ea9c3aed9c85738db60049a4a53740799636e1e3a3827f9f5a30b567d8ab43a635f30442520615e8b8218aba91f309a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c569537f3da37ecba2feca45e23250c4

SHA1
162e22368981fc1a019c6b185384e7d80ece94e6

SHA256
7ebdedaca16d05b53bb00fdfb054483a7f5bd26f8658660f695b0d7b6c25c2e5

SHA512
13677433246693594232720998415800d79405e94f27ea5be00210a77ae1d94c1142ee94e6f68fab2d49fc2aa316862c5106e7961b1bff37f9cb971083d28c21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9D1A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9DEA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit