65c6cf5e1176d0a705f5cc04e5a157a57972696515a9e5c19a01980d5d5a75b2

Analysis

max time kernel
120s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0237e976ea04016db6a6be5a05525fb1.html
Size

34KB
MD5

0237e976ea04016db6a6be5a05525fb1
SHA1

9ac0babc03e86f23f0d698d84ae0423dd5bb8cda
SHA256

65c6cf5e1176d0a705f5cc04e5a157a57972696515a9e5c19a01980d5d5a75b2
SHA512

5f7f61ac54dba78228c75401d99e9d0846a091862fef02712543a48f86967eea80942a49715d6930b1b8c00b702f3d4cda9cb79af159b9971f9c9f54bc358537
SSDEEP

768:RnH+Tlmqlih/SBazqvE+lgqVkcqOENRqlix2isq7KV6vqS6c3cLrjBY87lEA:Rn0lmqli9SBsqvEgjkcqOENRqlix2isJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A4C5AB1-A31E-11EE-8452-CE9B5D0C5DE4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000004562f6ed7e8e811a7e3c942fb325719204d5b091fb7ea39c74c7f6d8bcc69450000000000e80000000020000200000008acf2fe22e0d31910a3c2a43f406bef127ee6a8bd80aeaac11145b252d222a18900000000e10794d951b49bace2b6507cca570c74dc44431c920f8de524183d914bade1143829bbc939488f320d637a3f8c17db5cde130429c03c2796bd9cec48703463d050e93c5925d88347579860e4221a36c4a592bcf19ae5eb477326bf91a294a82504fc167c4c323db5e43df655c56307ad86f05d09e904a85a70abbcf045a49856439aede6bd7bfd6fb7e9158e5060a3b400000001301bc901283f9cb559302ad5c1de498252fd27bbae35276ae806b3f2323255fe00bb7253a85aa269495b7b9ca32689a1e789afabf2992049735b44e2c953651	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000016f530f9b4bc7e5bf16649b850e522e2ca66b073db22e12422f2625cb3a4c337000000000e80000000020000200000009281bcb8ded7ead94a8c078d098e5fbb42267db07a257ddfffeaf7f2c5d081f72000000055fbf2151bb6d3e3c824c31f9e4a8bf9221ae61cb5c51b9ccfa481830820f04e40000000fb4fe382177fb5cbb322a0fac04c7bbc4b3502a00a4557bb7aaa3b986756b0ac7e406f032d87d1907bff18198325e0ff4b62c05bda299ecf0b75abdedd2ce8e5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7073bcef2a37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409667919"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1576	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1576	iexplore.exe
1576	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2688	1576	iexplore.exe	28
PID 1576 wrote to memory of 2688	1576	iexplore.exe	28
PID 1576 wrote to memory of 2688	1576	iexplore.exe	28
PID 1576 wrote to memory of 2688	1576	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0237e976ea04016db6a6be5a05525fb1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1576 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
482f970abc03aab8e757ce41ce8b660a

SHA1
e926b8b0b4421776d0b1a8bd9e47a9c7b4c760d0

SHA256
d7f9e5ffe50bd24bd0530f5ac0ad68e5727b1c170fb18c819b8c3b7e4be36f3c

SHA512
616fd892fafe1135742ad6a803f53c3a27bdd07ba795fc5334a74ccae0f38f758a52ac464a3a89b2c6b0fa6f5643158531138f01bed5cc317a611b7613b9f8ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75e60da9b40efcb2de5479a88e157a97

SHA1
7a5c2abbf7559a6bfe33f5ed6981a847f6de7350

SHA256
1ce9f9472afade809c1d44ff66140f8020e1e6ae14765aa8eebcf7c93bf83aa0

SHA512
bdba4afc6ec9fdf8f3ae4bd65cd4c2267349b31b7040f980ed8757acef707893279f27bd75d7c0f56901b8ab4eae1950fd162035f39818b58b64e961a7f62cd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbc330f2b3eca3f6d443296775acb697

SHA1
0df9563714a5cd45d340cb7b75a69d3fc124ecb6

SHA256
6e8c8c5f23998d3a4a44434d89c7ea7e56b431441c86d4b699d40a56e3979e69

SHA512
07cf2e61a52ba68e3fc941ddd65a6a92cdfd8810cabbba2e0c991851676c18b6c0429cbd78c8746532e29f248741c78da80f7ab1df6725829763b1c3d0105bbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed9973d7744f9c3a72141cda6d5e0d09

SHA1
1849bb008d1b8113ddf6d774339cf0ef12b1a7c7

SHA256
c110bb685bfa42db58db39d8e35274908550062bf0139c0dc603ae35f18cffeb

SHA512
f32e25fe42e62b8b5e83abe16d77ff438a02bf0144456b5f24da7f8adac3cd58df9f02f5ca1606e327a5f6dffbda2fbf1f21b688cddbf3ea1fb88dcb8b440ade

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d51d57142729493dc27081ec6e9f12f1

SHA1
d852a01425d89c0c364998d344c60bd8cf0a1340

SHA256
5ce99d4ca26d1fa07ee9b493b669756a69cf5ef9ac3d0113969e258031858562

SHA512
cf171438f396ae354218079573d1a484079e5f4a36669fa13092d889ad7b0673ba69211b67a105d868bfedb138a109e65231837809e9d05077a93b1d85abb44f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd650cf4491ad7952b623759de6255c7

SHA1
12a2f2f649bc947b781f78a7c1f917b6cea2db25

SHA256
ddfd2d4630ab67a04b92eacff05ce25ce6d2fb48f980bc7275580acc527ae10c

SHA512
dabce2d8a869937b31f2009b4cce3537a6cbdfbc917cf361a9b4e45ada697e61c6dd3e152f5dab2931bc0e24ff310ac1f7d4441632025c6f6be374318a90bed7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3959d7ee4383e15c9705febd8ea39751

SHA1
a279ed5445b868a36662f14ddb391095d98f41ce

SHA256
ebfbf138ca5b3ead4295e655d2542528a4094fe3b568695cbdb35f7d1ac96738

SHA512
b03e5ad23b7a7c5317a9df6dbc8852372be949a9833c51684b37b802685344d88c1d893e52a0c1007c15e6bde03969f24a82b219b9ebec778f17145dac2e08ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5ae62f28a0b759fef34b806a69bdc87

SHA1
fb16bc2c876f7b367f250212b45f634d5a67be1d

SHA256
4962c3052e01b75cc863a6cb0d9c051564343c75d11b4bcec3da54b3487a07ea

SHA512
d08b3ef5969a789fe638eda057e3f761d8f746a93b4f77f9729fc5266a34adbee5b1eab7ca00276044f4ef30a7683e9c6606f22b45e36245519d4e046b1c391d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acf95cf6633fdd5aaab300c6fa4c5dab

SHA1
0108679403ff4bbda11cdd54296ff6d5c4ee2d63

SHA256
2837188ba0370e812a270db7c5ed985d1476a1951a5ddac7eb9fd456af0329b2

SHA512
508b006d33317546c470fc9a41c56fd3a06c6a9f5a06b9d5784cfb36963ee1e9d7f91dc130a5a1feca79cfc0bb4ef0dc6e2a20219d825407a72372d530376efe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
907e466b1becae1524b1e5b1fbf038b5

SHA1
8fee49d18c1409f646ae6f29d489f506aa0b159b

SHA256
fb136a620823a8551cf0ed633fbd9dd7db6c3644e5a8be5af894cf53c727b0e4

SHA512
18a0767d57db62576e048e3ff60a54abe66728b27c42fb768cf6857a8f6a0812b7c3e804d2f92297dbcc4101ec298bc1ac550f3e217a12320e655b9f13c17c91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc71f19b7cc9c39ce7d939f7dfaf6604

SHA1
309744bdb20f14a80d7dc431b65b998b923c3fe2

SHA256
baded2d424274f9640501b0821f9116d4ea49418ad1d2a13338fdf58657a9c39

SHA512
e11f3ea2510bf09dc721a9015569ac623007e78fb1a5b582332f558f1e70ecf2ce4e41aae0349134f894b92f16a8db137e012ae1ee88ffb4266c9ace395bbbac

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBFB9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC596.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit