34dc8d2c2d66ebca46e790e36832284a2aea33904eee996ab49b6006c58aa1a8

Analysis

max time kernel
137s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0459123435435d629b7f0a29c904553f.html
Size

50KB
MD5

0459123435435d629b7f0a29c904553f
SHA1

57296227593c680c1836bd816030391e25bdc306
SHA256

34dc8d2c2d66ebca46e790e36832284a2aea33904eee996ab49b6006c58aa1a8
SHA512

9cd7f4a7b687350efee69a7cead0c2996507ef177ee5f0c882ac1a3406f03d459603ec20742853d03b79196d7d5af60cdc6f5ca39f7437d5c9aa8683e830f106
SSDEEP

1536:3UTaSOCSN90ghNxgefN3MU39DMglNJfXwJ0:EyCSNegeefR9Dt+J0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e0283a3637da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409672736"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{64331501-A329-11EE-B383-EED0D7A1BF98} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000ac0f2b38a9cfeeddd9567807d1014d56034ab0cfebf1d879d055a666d0b0f910000000000e800000000200002000000024352218fd2a143d750cff8531155ed1ac42f5294bd85482418e317cd322f81b90000000897b23d37f562f2968a73e3b24785a5a10b249e206e1d3fa6c3f66b3a2b115ca90e453b6235da1a244f952a73d83e85dbd427cb25c0d37c2123d9a7b43fd46aef9036b346cd0a493349b8764906c79b27f1eb8a3edc421e2cc7a80102f007bb5b9617c1908eebacc216bc5019262f298ad3b30d05c3163f000455d0baf9ca992032ff2281e08c31b11b833a6d72972e040000000a9760fd938e42c030be42db7fdc9e2bd3b35e646d40d22b4a87217aaccdf32248672f91a5b0a2bb7102ed474061e686b9119cb8ee07236361c20c266128060fd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000000e19117d50302e380e591371e33ccd296901edcfac910baef6b64b63aeb64eb9000000000e80000000020000200000009a9cfb63d5997f8e8ed2f8e6c221b3cdd209aaa46bce607903ce864fa283e665200000008ba3d439af22ce33137f1e652509c5faa4f03b90fcc82a16172b5184eb4333cb40000000d2ed264b62b1ae36b7c8ece54a5f9a021ab13978d1dea3c2598a08b9c33e0ed9902bb82fb98f49a4568ca77f4efffda210306b7dcda2f942d02504e31160ff1d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
284	iexplore.exe
284	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 284 wrote to memory of 2388	284	iexplore.exe	28
PID 284 wrote to memory of 2388	284	iexplore.exe	28
PID 284 wrote to memory of 2388	284	iexplore.exe	28
PID 284 wrote to memory of 2388	284	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0459123435435d629b7f0a29c904553f.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:284 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5a6e1f318c815148cb484dd3a603a64

SHA1
0a89b39966333490e49654f2f423c343684a7a0d

SHA256
fd369cad2e7ed989259d582d2b89da1eeb3c62b1229648fbfae8cb4e9d1518a2

SHA512
507356c36d7b7430c30db4258651f418c8475e515c83668762389228a30cca1336c63036e4f8704ee91e9c2a38e3d9ad41b6584d0a74e4dc4362ed49bfa9d4ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
caf9c82a16b73ddb5b27bf6ba11b511d

SHA1
10137a6a270d7bf7fd279dc25f14e78c194de1b6

SHA256
905c9be0b861ca3015cd31c548709025e0cc44265b9f299499e8daed1db693c0

SHA512
8498c658f3ac1306279806d6da0e9d32ca32b863da1652e623d346785b55ed34fdb2af8510557de197993affd14f93873090074759b6caf41892060a23deb058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4951f984489aea180a9a319b3fecb00b

SHA1
d36adeabeda933a8bd5756d62e145f7da10b65bd

SHA256
c78a36b5cc57fbf33e7ea735485005a95eb48a913ab981f23f610260ddc700b8

SHA512
70143983fbcff31aa1e4a47decfa390f26b257434ce647ea099c9c997ea2a43e745e497f188d41c67c9d2a116e8f2ac512b3800707d643fe5fd844d9e4029f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdf3613e04efc20825d8ed536c96d9ca

SHA1
8e52408ffea7c0001fb838486a4090263c59a929

SHA256
a03eee50887088d6f91bf1bc2b552325ede4de15aeaa4721a0f6628b7ed2fc1d

SHA512
80509f5bc52d75ed769b1159433cadd3b59d750344abfe73abbb868410a6a408b9eb5af3ff1939f7086b27cc0fed576b24acb0c1e38bde88ff4a09c23461252c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a1fa89c04b53df769c09ef5e9bf4e92

SHA1
63a735561702c431045f532d641b36c36dd38809

SHA256
feb8a6212f3088664044269cf07aed39afc31e2df1c8c91d22ce014fa0942cdb

SHA512
094a8ffb7d82815966e7eb56fb1c1971c9a467069a700653ec6f7320ca9960754c3618aadbba1d8de4edc1a905a72ef213bb7de20a11068e6fceec3410b103ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ba7b6a1960bcbe28228726ca386fee4

SHA1
0605f5385327fe56a47219421ef22937413875ab

SHA256
e21b30d385c77f4d034d4d970616db3216977d0f7f86943ce13b6b07c3ea3031

SHA512
4a7df9e74e7693b27cc7941c96cdf464413c8bb8c4f1ae90ac0e02a2e474cef5894b95bb36bbc19aa424ea8c574c8378bea4b8d6e4d1c30cb1514e5adcd88f19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74f2be7448f72338fa1ea137fea22d43

SHA1
100a7c12730e401548ea60bd56ec32c45c80c762

SHA256
c56cb2390cb9884c6d34d7fe224e2e0cef4d153ca2c6ccadceaa0bfa097b0eac

SHA512
1da376ffeed0fd3ecf773cf64f8c6179b701e408019ad56e7058e293136fa2bdae54a66b73de5336d3ee809ac186d6326d4f025982932c3dd0662f907117ca42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
747728d7fb270c691cdb798b170b9b17

SHA1
2415cd812187c965cbd8dafd252403c43035bf80

SHA256
d56b4b98b91f55ff084565257a0350aabb22f5a4ceb504cf30fb7fd8da144415

SHA512
a30caaff7df05cf095e48025423dc21ec1f2ab4ed067996b321b1073778c3c4a13fcddd63a0013cf3b3566cf33cf3b8ee8f0c239e5ec8679ae9c97f70e87bd5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd3a8cf21342bda41c08eba7788e2dca

SHA1
8d0b34ae7287a1305aaade1c8a2602a2f1254412

SHA256
4e5e378ad7b7863715884a7b0a2c2d10dab97faed5365a585d126e838409c8de

SHA512
bc7e0a52cd26d34896a1f3b40ca193ed35dff96d61f790659049307f7ef32b39d2b6045ebaeae89f79e94a89ab46d2daa5231a840dfdaf9cb20d75ecfa29b029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75873a19db94d6951c680ada0c3607c0

SHA1
71d55474f3b35ad67a8c9cabd3132cbb66d339bc

SHA256
8a565a91a398d6ce5fd87c37fa56eb72eb272ae64fe0bd33a99770214804605c

SHA512
a46366356b09773629958b92a549a114ff7ab446f47789779ca54c13a6019ec70a2fdac5f175cb1314fb8fc808c488a18e50e73d17c40a50bd5233eb9b1a7fbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa78661a353596750ce492175ab62448

SHA1
76956a0fa107062ec33db2a115b0e895005296e9

SHA256
47ebd4ebc23e09036bddebf8eda32c76aca204ae23b34a5d128115fe55fcb04a

SHA512
7fe9b15004f8b9a3ba62b0e70cfd4019f3d1876cbedffe08d67a8d80402962e754d3d7ccc46540ac614b851c059563d836a6c3a7fcefec22be0204f7537f9b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9954.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarABED.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit