e003ccb6ce07201a3eb928c058f703a46100759f4024d1fed136a7132d2d3a7e

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0699f0f9466fe7e8e0892f8496bea47d.html
Size

53KB
MD5

0699f0f9466fe7e8e0892f8496bea47d
SHA1

971f3c4f6d083e6ab5b984b283e3c07fee74339f
SHA256

e003ccb6ce07201a3eb928c058f703a46100759f4024d1fed136a7132d2d3a7e
SHA512

862104f5a221c9f07650b4736b29a5075eba01443881285ec44b28437cf5bc5e7d047b85f7ff505b2030e402b5ce87b9440e5ea8420f14b84da0e0fe018aa730
SSDEEP

1536:CkgUiIakTqGivi+PyUurunlYy63Nj+q5VyvR0w2AzTICbbQov/t9M/dNwIUTDmDZ:CkgUiIakTqGivi+PyUurunlYy63Nj+qf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409678576"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F49B9B01-A336-11EE-9695-6A53A263E8F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401942f44337da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000091e096bd6fa7fc70dfffe9e542bfe31c5d3f638b340d95b05ba1be7c67970e87000000000e8000000002000020000000536801526e7a2c7b282fb693b2aab432232ae6bbfdadbb8156b7b5adbbe018d92000000055356eb064ddf22720552bd6ed34cddd469f30745ab4a24c4e9808501cba9224400000008ec5d741b4698d334cd1f22abe69209ecc366a89648671f0187ad7caddc80a6f60904a69010f56b22920d553f22d412bfaa0abef5489ef7609e31beea16567a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d9b4267ef033601380fc96f0c77b8ac9fa76b12da53358aa1518904a7ab93904000000000e80000000020000200000005a0f6c1d9e50ee9b5240ed7bd7ebf4310246152e3bc03100814aef4a90e5f7e590000000569e9064848781b6c99198e526198421e6e2a5ebd05522fe9076793981568d4778a3a5cc5a97815bc7110b3b690541a86d0e9a813a16bfcdeafd7375d7b38030d84f6f9ffcb548db7e72bd0806d8d88b2d2160644f152fe82e226b32dd689c79e013040e8c74432aceda2e49a0bf49d88f736ea0d60aa8642440c7340218451b6a4e5b499598e99aa2a87616876d387b40000000b80fcc2f805ca6b281212e548b4c6bce6d55d3e570146b4da423193da0476118e953a5565e49b2c51ed55ac8f12f584627f39b8a9baea11726987908cc8f8c9e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2864	iexplore.exe
2864	iexplore.exe
1072	IEXPLORE.EXE
1072	IEXPLORE.EXE
1072	IEXPLORE.EXE
1072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 1072	2864	iexplore.exe	28
PID 2864 wrote to memory of 1072	2864	iexplore.exe	28
PID 2864 wrote to memory of 1072	2864	iexplore.exe	28
PID 2864 wrote to memory of 1072	2864	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0699f0f9466fe7e8e0892f8496bea47d.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d107cb43e6a986f0890eceb371c1021b

SHA1
8ab1c69190ad62ebad45d9f0e5899d8c063b587c

SHA256
8137d0f4c814953030487bd99511ec01dc143b7c8876e943cdccdd04e6c0fe10

SHA512
ea013a12c4d43afe887ef2dc28c5dc72a5f60b745d91f515ba97d437d197d781f7ef2d263467b86d6867cc8486034f0946a33bc6e373c073284826ab633e623e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab0a8de2bc359983d6bcaf80f918cb28

SHA1
67952313dd3fa792cee12ef192d343bff0535a4d

SHA256
ab6fe5257998100670691daa081542a0ac003e8e6df7259bb4e2c8400885eeeb

SHA512
ebf4b0cc2c0eaec0a9e2c6af35413491cc3110beaddbcdbf5bf5b9271b046008d8712a451917ef29609f01136b76d6d9441c3756917a0410fbe59210f377691f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5abe1d2d4b66e73224e234475c6715fa

SHA1
0782b352807569799511db461d2cb68fdcf0c90f

SHA256
2c6828c0801274946087cb65a87ad3d06a45d88264495f53e42a695f927a006a

SHA512
5ffa69826939dd7d21a5e05da1c31e96a28b16cb6c9079cd267e3ce2af9dc96477c7d59a5ac8284975d8438aad92a2dab19113eebbf44a9ce030be446de87900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5cb23a18da621570b0bbdad5a2fe9d9

SHA1
75dc60b516e22b91e512335263d4aefc2b41a87e

SHA256
57b1d2d82b88f904d5f1bf4cab4e41cb3fe38c48805ed5e54beb54505c2d9973

SHA512
e9546c0bb594ca864cad996f65bd8d30d8fa1e1c9e509cb9441a3b80b2697f690a8076455e1c70e4a76cf677acb25ca64916f1c9843d6651b11915dbf527ac6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8b7e95ca1956cce2f87c28658648330

SHA1
3c6f212cfa550c740a7e67a3c7410f74d1f32ff2

SHA256
ffec94b50b0b562775634058956295ece7b180ca17571062f64651976e511dba

SHA512
1e908da47ef333abc7b587b630d10fb1a8ecb12b7f83437c67b8efb727e86feea1dd1f091b588272a3d6dcb910c62f3cb38889369c90c4b5ef35c1632de47de7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84b53345d309fe0f2b67d7db2189de85

SHA1
36d3bb8f246912429f587bb26f64deabd329b027

SHA256
c9c4898dd8a650c0ce9bc2bade0e299427eb008583447c7be88cb2d333cd8a0c

SHA512
1f16ffd07c75f795226c041d1c4146000bd8ff1d159979abb003c3ef95397b3587f1619e437b96618a027627ad673f839004a59d4d070857a19690326612bdd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1ad49bc66907ec79528da1380a88a6d

SHA1
bac955b2e274960a348b63c223f57fb2ba0d79ad

SHA256
5869c6ef50a40eeaf1e89cf33f17cc072eb04b904762255ce5c683b774687bde

SHA512
d7bf48979162580844f9838e48f7e4578b3984d35c15281a8c149009cceac0ec41efb72431a5f432321ca41f36e56bb83f5ecce356b851d8b20dfcb6ce3670a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3681287925efc6cafd7d8d367fe7f0f

SHA1
3db34beb6091f265bb1ae556c5c9beef735d94fc

SHA256
92cb3ad1f05efe9fa3bf3d4e9b9a3f9011088fb39297c6a78032c09534ee84a2

SHA512
c38bf076234a00a496bc40863742be5e82a9637f0ba2f6122f181a0db6b6261f6cbf5670805457c291239d214962077b13db4ebba3a9ee55307605c619ede31a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
203e6762c2b314392121bb244443a251

SHA1
28af65bb85926ced9850191e080a203d286cf052

SHA256
6c72831e535de12c71a25a97cf2c0422d970858030e7236e81387346506e7946

SHA512
344b6a31f5548c012269089a28c78c184580136215e5cd655320a9624458153a1bc0f533c37e49da7892c68d11f5e839fd4b00d21acf9e251e86b3e0a92036b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5b5725aab09adbb153316e983ba2cbd

SHA1
d8dd1995bc11307d62759a65d46a407555e8e4ef

SHA256
fc756cb1a1c7771965e33de49d34641909f7fa7501c4dd8e275a9de8ae61c92b

SHA512
3b299d6aba637957c7a78382a261b349cf717b763f6fad6ca18bc938b360bdc54b0eec7a7ca5a890eaf3b1137c7e66d5ae02df6ed0ca393bf131ff7734ec323e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5015.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar50D3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit