3945e36ff57044c7b2826a1128e3486290e350373427094c400756037a17a554

Analysis

max time kernel
122s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02f063950abdc4637f26618422e65c7c.html
Size

254B
MD5

02f063950abdc4637f26618422e65c7c
SHA1

6ec9dc8c4f04a5ceed59bb6020e4d03499fcd518
SHA256

3945e36ff57044c7b2826a1128e3486290e350373427094c400756037a17a554
SHA512

696f99aef03ced40dc2c33cc24ad0d5f114c16f5c46872e0f13b86e187f4e81b2b3becbd5e8ecc4b699da7e050fb681444131a27a93c59a093c43e9e1f4cdf2e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409780757"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000c1fe348856ace081a41efc16dddea6dd78b510e4a7a17b8c83949a3695448bb7000000000e80000000020000200000008780c7b6da3871d64330af3b5e3f147a8d2a192ab0a05d4df983c8328ff4f3e690000000b149491d10ed4652c6d12b71cb3674cacba97838a93ccb0e8cd96bd929ac2fe5a8bb4e4f8c0baee91715caf6153918b18ad8087d2cf713718a8a8dc50b523ee01f3145e459be139ecf080cc379b3a2ca0cbfd0819fa873a06c107cc6fcce7de8696328b5877dfa2616b0f4ec3c0b8e92a8d470ca14f61cdd64c811a915ae415e5ab9c51a97a67df298b460c97fc6c28b4000000065d075b2aafa043c2045a218db4c89d23c1c58d2c41aa3e8ecc89e4b43eb0be39aed0adc7fa3562384986dd32f0d17629e64df3cc3695a7466c39333364c03cc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0055cbb73138da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2A80481-A424-11EE-86D4-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000fd9114272dcad4258b7d60d70df38471c896be19f8a617d9d7f6cf51879b2b5b000000000e800000000200002000000069def57631114d1541f9d53ba72317ca078d575d138def00fdafb95139592d0920000000669206ec31895e39beb893da491945154fe519717aeb7cba7fff4b605c63ae3740000000564132ecdb09a0eff0f99143a9c777c25544811b94fc92fdb630537ea73511946c3e7791acbacfcd6c6ed3c0f5b5cedef26aab94c1b695501385c9f07bae31bc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2444	iexplore.exe
2444	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2128	2444	iexplore.exe	28
PID 2444 wrote to memory of 2128	2444	iexplore.exe	28
PID 2444 wrote to memory of 2128	2444	iexplore.exe	28
PID 2444 wrote to memory of 2128	2444	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\02f063950abdc4637f26618422e65c7c.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2ebb2b80d4c9a21077478f1819a3e91

SHA1
f6621b2d14ade4d4385817a623209add6319877d

SHA256
7ee08603544c871688eb1132d826688a4be244032065074486c7e5a1b4bfe0d7

SHA512
ab88e005da21dffbc3e5b01f69be392ea3e3e023c62e9a64758022092e33b29678ab49369f98d2e5c8e69786846686362d2b7f306c39d3ac894208f200a0ff7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18f67163f2ac75fe9f4a00797afcffd3

SHA1
1dc39b90b82d3ab0a34d5cf52e554a1e0a9deb53

SHA256
9aa5b8f39d7c7a6f9df0f9e8f2ec70ffedabc99da0091fca38d79b95e764507d

SHA512
a615f52905f884336a356960ee6ff1dfcb54e45cb91115c2b706b3612959582fdeb2bad307e505fc6a710b412a477341995387c17b80a8097837f11566bd98b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0f4a4ea0cccdf9d76606053935676af

SHA1
a4a3c1ade410a92ad1cc4afd2436e800db1add56

SHA256
397d54d1d804557ce50b3a7d4fee73aa9647e4ce526a3d858615e8040457dae0

SHA512
1c60e0ba234a0974e1875bbb525ba416497dfa5c345c4ea5e1014603909e0d82e1b448d0ab9a0887cd277615feb984700c229b846ada6b6df9bc10ebc419e297

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3483d6e4f4918b8c519891fe5ebea496

SHA1
a8b2474c7e92b1b74234d56cae50a1dba54332eb

SHA256
197574fc3dd88a767884bbb40882fdda8ef235cf921973743e2c983791f4ab9c

SHA512
299cc06e4fc5c68f8c7e8aa6e49824a585783a270f8b1e396231e182b4e4bb6176f73b3937ee9dcba27c7d7f1f22ecdfa2823af6fe32faee527fa4063d005e27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60bedeccc9ba730bcc00985ed3031764

SHA1
5819b49dac562169df5a869b0ffebfbba5dcfdc8

SHA256
dcc8d88f1fe1851032406a2ddb0d1d408acecafbdbdc2057272766bc04391e7e

SHA512
d4a809a8e8319d963493f1d3e67c4a07f53d73a3eb0e27e95f06f9317188070e129a566f6a4e62b5120fe99c75d203c49504df5f907ee002c83dee64122b00be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c4e7f12fca9daafea9e73b065f06670

SHA1
dfbb9b0b8ceb544c46aa6274c3233493020c0598

SHA256
e18eaeca9dba88aa9b73d0176836a61e79411c9711bec6a61aed51e20989eb77

SHA512
b37a8819b8cae37f333c4a349137008efe0cbcb021ba73853442d7b68de5dd9c5f07530315ca7650ab3a35b57e02c66f3236a738b4e4715a7319a592b355a4d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
510f5fc0a2ff3c111e14fa070e95b7b1

SHA1
63e80be796c1749ab31ec69def05b01f84997c87

SHA256
43c1094d60ca4ef47fee5df116c5d93447fd61d22adeae80b21b7146f5f4682d

SHA512
c2546524a4f3968566f8dcb1a1b469704fbbf84f7e071f3e3e9c045c56ef28e0e84f2d4fb86951b84002f63b3a1ceb45a989c41148cdeb64558fc329480c13d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b58b453611cd995fd477de2faf80d76

SHA1
76ed29895815ca22b10c5206b3a2a9624cc8b92a

SHA256
6f03fbcd88a75902dc408ad41490b66d7496d5ae4dc06a2cebe4ad8b6d758058

SHA512
100cfc5ba7c61fba38ca4729cc7d78ba82387c8cfb6ac4b6980f68c265ac800dc5fc279552d24573fd98b9e6cf256bc6d0a47b12f8d122cb85e33584f0bf7d3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63a661bd9df8598765c6b9605f2f623b

SHA1
e6b408e2eb07e545c05ccd82c403a01520fc69c4

SHA256
cbd5ee05d989f8788e00ba460bba46952313a9c2a55169dbcce46101956ec04f

SHA512
c635aa7a0ac07861fc817c8b54457fe3764c9ca48f2b859ee5c8d2ac2b541b6c4c9cf20e07face991173087139a523768ea671def59771311f3b92cba3cbf2fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ccbd0486ee03332a1c624b608d89c0c

SHA1
897056f51fb71e197eb0eb63474c4b669e140f74

SHA256
f077ac136a4a508031e3da4ef3688190f42920fa8d15754cb6892f85284b2682

SHA512
ded074ac82c432efbfc5cc6a356e823f60298a44895275e2213e091cfcab4246f114867a1526e30c73ba57f437096e7426acc4c681c32c17b601cc9f1b33beff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7189.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9C09.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit