dce202769cab551d20587c6bcf0bc1bffa231b8cc3b391762baa86037c1e4fbc

Analysis

max time kernel
139s
max time network
160s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01ae9deaac343e69bef278b2108b7627.html
Size

92KB
MD5

01ae9deaac343e69bef278b2108b7627
SHA1

d643748f1808420a538dbeddd9cb486ad20524f2
SHA256

dce202769cab551d20587c6bcf0bc1bffa231b8cc3b391762baa86037c1e4fbc
SHA512

2571bfa1862b277881692d755c512db360f37455721784c9b932b44f1a5f96f05446f3e7b7e3b7618e06a8763adade729021527805097076b91998af4d49dfbf
SSDEEP

1536:gQZBCCOdY0IxCdxBxNZGMWY3w+elGnOMgxL/3Ewxzza/ka3Eetdkwy7nGRvCEmr5:gk2S0Ixi4Pd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000305032b4faaa69d3dc624c138c0effb414d97d0ac94ba7cb214e1b821180004c000000000e80000000020000200000009915b0799ab506e31840bb25d95bb131a70305e009572947aa04cabf46135df62000000044421febb3cf3945cbc9a1ab869fed9248fd0f28a459d2b100196aaa6c270c5940000000fba41e40d701bb9d9dea028bbbdc8de1c24326f6ea28e772d81b248e5720827e81ef3de9b2b69681e270d0f8f27b62ae363d30e611ca331551238a3a1ba60768	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c52d562038da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409773264"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000041b8da49ac171cbd4599f3f54f0077b54d5a4eedd538ecb637a8d6f2dfe2d971000000000e8000000002000020000000a368fa5d6c85e9d2c17b5ba75c30da912d599c3c38a5d9e88718f576d9418d4f90000000d8406ef28ae2312e16c166444addb2bfef3c35b547888faca9880ab870e3522cfb13a0b7310e591501564889378e8c64530304d757c8b9726d9b696c9f777446262ba6d8ba7d68c6ce8c088c5fb1a432f91cecafe02a2b019010a1230e22e85971ed846baf45bb450a1151c04a334bb75033e821250158c4aefb6075397d71f31307526c2e76e17d22678e022bd014b640000000fb32f89a6df6ab3a142f7540c17cf31347da95fa97a49a9087ec065358a9ee893f36ef048ceda69048bc91c60f11f3abdc95413751778147bf682d96c6d189a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72833F51-A413-11EE-B331-6A53A263E8F2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2348	2400	iexplore.exe	28
PID 2400 wrote to memory of 2348	2400	iexplore.exe	28
PID 2400 wrote to memory of 2348	2400	iexplore.exe	28
PID 2400 wrote to memory of 2348	2400	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\01ae9deaac343e69bef278b2108b7627.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b295323b216bf2af70c9c4c6726230d8

SHA1
ba342716b48cfa85be9b847ff65e844e3db9da3e

SHA256
c72f067b371cbc256f1e730c14ec8bbf2dcacf67c3bc6b6b5b57b5f5137025eb

SHA512
f6af4525a6f8bd81f5dcd81e901c873b5bf85892ba6221d44dfdd9b8906cc43f4239d758d5bf7e31a3c246e00c57f3c728198de994de738c6c231613a98950a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f41a72c73ee5ec510a9d25b927c7cf2c

SHA1
ef6cddacc0a59d0bfa1b88a62f8f2565d1bd752e

SHA256
95db2cb1972319fac18064ef6ff368e79c1416b304510693f16d8f36360acb78

SHA512
abf6cd3cd7ca72ad3471d93927fcfadce02317825e764d070c9eba34e19e14d8c2c3d513cbec99b744f31e90f644aa605e11bf2ee988ad600c8b8e2e78f40a79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f054dec7e60a6dd5a03c56a852423a5c

SHA1
549641d020564b95795c1205b3a106440193f928

SHA256
4796f95629c2d0f1a9c1b813443dd76d82aaf59b228c0cf4297bd46b886d8b53

SHA512
ad0b55146b6a194d430fe75718cf2d0782c64f7d27fd58b3ac0671a14650d4d2edb558bc80888342656d3ac0dfb6482c292a9c5052fce86764252ffd5a72ad54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ef7acba633003b270f8fed27f74b4f9

SHA1
55b1effe92a992a6e3fbe8c6cb7aec07424feacd

SHA256
d56d908646c1e8c73c2396cd473242c5fa56fe724b385ed0f3bf31b21cf4f13f

SHA512
3f9c69ca062d50b69718bc065893d8ac4e9e20356ec5616306403b9a25288a3233fb8d04fc5f5dc865375dcf36333245cc7761dc3f22e37e1f3811363574d5b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc866ed4398b85e785c093d5e2fe42f6

SHA1
8ee85c5e3f2a04816329b6e9ddbf070377320d2e

SHA256
2dbd0a3b31fba3a8c67bb39c857f146450693f0f30486bbcf83d4376cc28e41d

SHA512
7dc7208a87d1a602240f7ffa06701b013ba976ff07941342236b062bfc27de6c784ae7b8dc2ceac92a6c1f85c6e47634194b04f5da4f4d5dc94ed0ba51e9d45a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4aba4504619e12d977f72f934e0204e

SHA1
fb15ce1694d76825de1967ebcfa4f7fa85edcb20

SHA256
0f5b88581f1b236b7ed7c6034c8e7c47c9be405ada70a122fadb7762985e3969

SHA512
7345a9c44565538c31cfcd9dbb45bb0adc6b4719add9884e2431fe53d3e5c8684411cee2378fad3035590ae9c0a2a0912ff5af2c90c6ea7102d16dd738897823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f7706581b9f1c147ead852c58036640

SHA1
74f82fb9977268ed7bbba930ee6f8d6842f9fc19

SHA256
be639410e5f393f9602c17d068a874cd35cf8024f86525ba874be815b28aeda3

SHA512
eba75b4954b887b485556f509760654935201527c6d99ad75196aaf39387213d172b62c5d7a29a699f46f71ada4358675c81dfc91932915c4773b8f0095c58be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f7e5c13a045f5536a29cbea0d646c80

SHA1
5b2addbde7434ea0f6e5beeef1bf63049fa508c9

SHA256
87a2d043fc9bf0c37106a0e4677cba19f49218965f94f2df685061c075724805

SHA512
47dac0ea0d7c14d6a52b7bfaebe3d9e09b3feb98abc61049c06415adf05b922d7ad1204fb289d704fa3f02e6d550c149b975036bed13ebe827f86f3eb9c27d6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd6b090f23698bd64bee5d0e8ff68071

SHA1
e30bbd57df158a57c8ddece5f0937eecb68a66d0

SHA256
30f94c5e41a44eca443c3919c86dd34a23c72e09259737ba2307b425601dcd5a

SHA512
2bab316bf6c65a456a65f46ed8359e61a95cd906fc53441344239352366e46ad75cc14036622ceaace7e40b0ade6c1d69b43ec403fffdbe23f108e571a133e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8399ce86a506ad1a622ebd82967209c

SHA1
b1ce8cdb919af603762a9d75fc74a7fa7c6da016

SHA256
8880b1067d41d30211c9491c30ca92322c13e8b190c29431ec3f6533b71ab51a

SHA512
291afd2a20712ed4ea3dab6668a7c7f14568ca1e80e198faf25247f8899b1badd6e7a0f453195416f191642344e19165e2194b39530f72eaef4698093ee8eccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF634.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF6A4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit