dc29e186ab9035a08f7a8b69332e75b598d4bbfa040b988dfe2a54bc14288dff

Analysis

max time kernel
122s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02ed7b92d03e6c13933b4eb5c9dabe24.html
Size

26KB
MD5

02ed7b92d03e6c13933b4eb5c9dabe24
SHA1

475be961f3996363fb4db74427d1ae41a6421713
SHA256

dc29e186ab9035a08f7a8b69332e75b598d4bbfa040b988dfe2a54bc14288dff
SHA512

62469fe99490ef292ffc99d505c1f4d4ca652b77302940dc96cb9a5c9e666b3bdcfcd818f99c6a86cf926a104180fe8a995358db85571ae868bea5f97357e379
SSDEEP

768:joq1/lGUVzOtwCLoYQm2m07OcOmsmiXo10C:joq1/ljCLorm2m07OcOmsm30C

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90bdb92a2e37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f73638560f3a2014f3cdb49f2d40a23f2774dfcf065a837f777a6da77ba5f93e000000000e80000000020000200000006e09944d1f1232b33adb33efb85f2b4b2b10baedc643263c0577c94e7c4891d320000000c48f8f131fcbd426607009f5074ccb1bc2c88bd4c3f27fa1cd133d5c02f449064000000043e0beee96a2af39ff45f09e58de452cb4192356f17cdd42740dcc563924b95b9aca20e093bec99e8deffa0bb5bc2ec8073e34f46aef89a86451679cec2a0632	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51DCC841-A321-11EE-9840-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409669270"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000005f40b53fea6c6b240963c047b124ee466f5e3cf80f5478bb0c0e286862d21035000000000e80000000020000200000008b527893605ffcfd9d26e3e998fdb6373f4346c85058a60a18311e458eab9fd390000000395dca3fe39250a9c4e9bde6a7b124226da46baa6d697a4c764f4a27164722ce6b1d2738e39a77131db1f87782796abc38fd65ffc5499cdb095fb56c376b8bda7df7b841f3d75b71acb6109d4ed4ccea4e060f0b730046651479e4f569f2ac40c63fa75e66cfdcd9b679a720ec66ed9459392e2292ebcc425a05561a1fa17cc5b6f16e8a99d19cf4e7bbb25dd6669576400000007dadc90684ae9dd2feb384bbd9f38e8b708b2bbe0d71ff990b502d6a6361dc527f9d947beb7c06948b37bf50bfa1a947e9580de4136b43611f7c26a088d36dcb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2260	2420	iexplore.exe	28
PID 2420 wrote to memory of 2260	2420	iexplore.exe	28
PID 2420 wrote to memory of 2260	2420	iexplore.exe	28
PID 2420 wrote to memory of 2260	2420	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\02ed7b92d03e6c13933b4eb5c9dabe24.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9725d42173593ebce1a353a11c5a63ca

SHA1
5516f21cc6b90a830b66ef0fa6248a3529c962fc

SHA256
1cfbcf59f07490f3f0b8ca3c72984467bf43d7cdcecc32c582898472f55e1488

SHA512
809495f89276a60af902af0cf9c03d02bdb9eb29bb9e6fafcb43b6966beea113c19fd003ed94861302ae8ccb14ad1aec21547e36dd39e1b9d4fe2887fec21802

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59b3460d917babcf56de1126a5623adf

SHA1
38b21ce4b06a8e9d6364c13f24698d197cc0ceaf

SHA256
a88a6ddead6df2ef7e08c469ca116970843c3cb36061ae6e20c5b472a644211b

SHA512
405dcb0ff03f156bb13279bb561af873e8fe61f2443ce14e3ae222f71f1761f9e03eeda77398aafd14c667fea4f716932ae28b027eecbbb24eca4afc8f33e5c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
581c0c4054996a9538fcd9cf50ed80c7

SHA1
001bbee350b55bbaf5798c8bd606aa7295b6db00

SHA256
40a2ce8975c53f3e752dc7b749b150f89664a966d5911de836a71cc4114c4701

SHA512
de8699b7da54f134e108a761c715139c18c456383db41bb900fc312b51bf99e357da89ac6e72948e8639e1ea1dc02d14f7ea1d9c657a89f4c082881180f924e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae1e2f677c6b18b965232a7959973ed4

SHA1
0ac66a1ba13da76ca3525d45a53a0c61d5442e8e

SHA256
b54ed4cd12f53d183fa5f6ac400bbf7835163433ea0aae9413a9572e3ad8cf53

SHA512
5d3876a4de77e397e980b7db1abda6d7fad2aa83df585985c76e97df41f835a9bb842b5f9fa282de17db8cb86eee214a395b1e87f2cf1143a1abd0dd298f6076

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a161779e55dc4e97e09deae5ddfc2817

SHA1
a742333afdf5ff70a4c33ccb269b81dd639bdd58

SHA256
24b20841a6d79ca1a3dee549efe8bfd8d94dd753204cb9c36409172d53b56516

SHA512
ad3e2985065f25e3773ba4d027d839de7801c10df39090a5eefb71305ad6fb37918cf9130ac55a9fbf2e0d6414bcf1152db815063350c697a794cc5f6846525f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb36c248e18485195d9a4227ad9fe29c

SHA1
52410e051d68d588ca8955b131920dae4c53a98f

SHA256
766e4ee2ebe88dfc3ecc5b54cbe82706630ae6b93173bd2dbe669318cbc524ba

SHA512
b4b4e919c5ea6f78b9a395304bcc9141d6f1ae08ae913559b13581b133443405a59c67b8e687620f4d6780d6e1578bede1d75004f6f1dcbd4c3be1329a9b8253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93c9241b137bfbbaf2d734aaeadd8162

SHA1
c4a53157bd97d9c502279884650d78f4084b5244

SHA256
ebe45e292015d1aa39f38fae0674cd1ca9842d0a2400387707f7b808514e3f7c

SHA512
96302c0901a54dfeb4cd42136b1f1bb772c94884a35647dc922e78307d22d9a48c7b5b582962bcbcaaf71d6d02b6bbf4b464ad789771d8625843fd6a687a0e67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea4e0411dcd2edd0aeef0f551c37c3a2

SHA1
101f0c1da626bee1d93681a0d186bec3dd236571

SHA256
b7a33b2060ba762dce233b2d4a1822c62ae8a5d0a05a016d7066a2af69c62baa

SHA512
1ccd1d2912ae991001485894d1277d7e6291079137956673fb0742e706d73791c86b724bb379f788d8dc1b8fb95f4275f497581520c4cddabb8299e88caa9626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae9ae93767f97f2aabd06fc2b61ddc8a

SHA1
e9a789c48be58636e9c63a78db28f3da0c487975

SHA256
85191eed1c401e06373f1eaaa43644fb014660dadebf910e84bbca72837f48f1

SHA512
23174764f4a3c3a3f48a3df8103fe34c4372d26f724b96e457660b6930607b9449c3604678bade0530b72b6f2d841ebfdca94c47ec52577bb3a459e319e87c27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb5b92ec13020c0c414cbb7a9a46e108

SHA1
05879cffc5f0d281119536306dd09c203f54b4f8

SHA256
8e1380e59f9dffe4ada0f5ab9ed1b9f4d22d881a885f35e84961c106b1abbd41

SHA512
231496b9da147a8cb529af5b9f17494264f9693363145a07e09e46f294203abf49b6ca20a51b9a71d5b4523e4ccdc694bdba561d322cd9fcac60ab5fdee683f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcddd85b44550cfffc992b5aca61740b

SHA1
e6ad824809b3d32c0c34918a6b028f4a8731324e

SHA256
fbf51b2ec07dec16bf77273a13f0fee81cb15ec14750ef32aa8fea37f6e07c64

SHA512
cd87eca0683b107ed357ac19abc1b254560e21ce6c45c8b12a175db85ea721321977742285ddb9a27c324e0642f53bd078ccc6a41d799d328075a6c01cf5b71b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f991de34ad16f82edd90a4f965f8fc8

SHA1
9349853fee01f6a119e0c03baa776b224de38542

SHA256
5bc5566597b53d861d1f28b7e5617637ce973031ea329f8c81beb58372e2dd1f

SHA512
132174c020a5599bfe85f62399cb473c6d1603be7cc3d849a70dd468341c08221fe4e9ce138b437dec0cd054cf80d15388e8289ddd9c2235fa5b3f8486b23bd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9f2ab1de1bd4bed4668f93035b33744

SHA1
060983d784b2e794ba84c72fcb54b7ef4e192b61

SHA256
a01436c50e2eee5010b72c66e23b8f1eea6e9bbc20742207651b2f6df57037e8

SHA512
f4d176c17e6c6c685bf4693b57901d3ecceb22283ac4373068d5928467c7ca5b1a668b4f452ce621fa41be6cc13b778f9d95435cd7b6469fd55a35d6ca5561af

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAD33.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAD55.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit