df2e699ed4269afe611dd12b7c8e82198e43b4b0cafe556ad07ff582dd6a2deb

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b12ef9f51d42eb3665723d79321ca24.html
Size

3KB
MD5

0b12ef9f51d42eb3665723d79321ca24
SHA1

1c3c2f29f8bb3516f77d2f4bd69b0a3465207581
SHA256

df2e699ed4269afe611dd12b7c8e82198e43b4b0cafe556ad07ff582dd6a2deb
SHA512

c2e33012b47540d2095297d7ca70ab6a4272de31a316ae5fa84e61ca861255ff7fcd99291afb2aeaea75d30217849a4bad16ee931404ee48246c83f02922bb10

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3093C281-A34C-11EE-A3D4-6E556AB52A45} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000008b0ccb837c046b0ac0db5fb29be854ffd2ee6b40b2db21655474c0247fa8c609000000000e8000000002000020000000e76dfc53aa2e0351c228ae52e29e73425f697a7a93abfaa76f87d0e0ba05df249000000080dd50abe8e26b5875f4186fc5694a5333f354001015eab6119894da31647c84c2819b167a2710472099e59b326db350bf5d7e86493ee7275d3c17facc255d6864037c36671b4962e65f0a75ab67a4da3e35c3c4f511c9889b66b37b6ee35ab25c4b247a70f798175ae9f7852069c8c94c4797f08e17e3e5d74f40ba408f14a3e1251db86e9280f2ee6f8fe0b0fb499740000000f8d502469a183782f1a02a4fc45a3ff79f70cc0f2dc3d56a94709887b9c5b9991e61f478727cd81beef52c261d215f40d15436c479e9a2b2b82cc797df8a783b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b51164f48dc40c672384257992337657c42316294736fe5c1e7f8e95a93a2c4f000000000e8000000002000020000000b2c4694c2a94f344072128e072b01bbef3ba6eaedb37c676557dee00e369576220000000037de2b9a8dcd9f4d25939f2ef5331cc21362aecae850377c54d56595d9be58140000000940ada1aabcf0564eb6d071fda22d19e1342d732700bd2ee1493b8258a30fb700aff46db64fc25dcad9b233cb4a0da3536f17f0ca1b682adb4d1de675557c6c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409687681"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6093040a5937da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2828	2212	iexplore.exe	28
PID 2212 wrote to memory of 2828	2212	iexplore.exe	28
PID 2212 wrote to memory of 2828	2212	iexplore.exe	28
PID 2212 wrote to memory of 2828	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0b12ef9f51d42eb3665723d79321ca24.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a343b17e2df6bb5bb88353a7abd0a33c

SHA1
655fa0c9d0e15f1b03dce1506999b2f72529f945

SHA256
0464e74b1de39e512c75ac79af6a45287dc5f911dd5aeaccd14dc4fd6eb762b4

SHA512
c7ed6c0b1cf1c45f9f9a9c035ca3ce48966622db79177b103945520716d5998b12437043c01374319a896f5128f98dbddb65cbab074c54bf9555cf22a4219475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c440d1529aff90c1745a2c0d26c1abb

SHA1
3a687fefee3929175d3f44f5dc211bcf0beed4d4

SHA256
1947cc8d7479d60797fb8795ad0f1c4b5e3dfeabb2eaab18916805b4f986bc02

SHA512
9c056a07d47d6d71ab5c744a0205b0d399c1c4512e497d2241f6374c1db6a5fffb3241e6fde42b542f373f4f7748fd63998e2766f4c0ef3f90da7a146e3e874d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d5f89cf621ee8f298af42c055246883

SHA1
99db035cd6b3f683c16827a53f91c49cecfc9101

SHA256
b18f9f9b8bef8321baff01c8d29954dce0eb267afaf4d248f0b3032d80aa01e7

SHA512
b3757dd3eb05d2d4a5f4bc2e6b685ee9358dbc9f7ec2527a88294ab0be3b0d215c4faff30f30ffae34bf4955ee587416a7d3926b080cdf04ee5fba8609155d4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93701f1f2d0e4214b3d5ab9caa0545b8

SHA1
3252d72f1ce78eccc492b74087a19c7cb658fb5f

SHA256
3a1ed8d58fb2021f1365d5af4f77f10080fea843efaab4f4f2dac3152c1b4461

SHA512
a57c039d92e61755bfaaa4aa13e1aa73d2372866630afd1f37356b5504f4857a32765e4e677e91deac300dfd267f6212b69ce33cdb43575e13b8664e08d3b66c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91ba4582d5ccd5bf7e3891d4df188ec7

SHA1
5cd3b9a88f8add5f2af7ff159bdb94a84d280bf1

SHA256
0ba7199c5ce4e0d71ff5d3501484647e5f03758295ef8b1ca33a943f4182f533

SHA512
28a16e03927d1e81b0cf3de4629b44ac6698b30e32468fd3b7278f9feaabe473e5f81fed8d405006df865ac32d5a7f62445d7467b7624c483569568e9d5a8ed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b70222535a32ee2da82a0c1686ed2fb3

SHA1
dbfb003067e4aafc03ab2241523ac31118c11eea

SHA256
2e9060a9221c9858e541bfd858bbd7cac53fd5134a72b68b367fed871ab23672

SHA512
bb0597fa2ce96cce531475dd782825ba3d2f7264947f9457eb6e64a38e3ac7a7ce5bc35ce8302e2b4ecdbd6fc84547323de6e3df8a17db45c10b9b3596927f8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88ad2384eefc4ee7586afd7029ab5d21

SHA1
74682430f19a71120f55182f6d04405b50054478

SHA256
ad26165c4087c7f26a90fcd0b6a0a663b7ae27c21756d37e1a266590b6d58154

SHA512
e0aba32105c28566872d2ec7a5d877813ee451654b8d6abdd5d912ae6f4b5632a7a336e1098ff9f94df0ca005b91a82836f01159c7fe892762f133e5c2dcaa29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b9af87ca4c9c7efb534b425fdd3f3cf

SHA1
f309306ac877184d45a09a03c4f6c3327ee7e094

SHA256
05f35bd4417840c0b448172f8c09e98e4a82004b51704f0eb8d9445036916728

SHA512
bc8560221bfe7ad4573821fd8bd5f16317ee069db9398160aba08ca0f430c69ad331a743f783a331822adabafc59bf97ff232d30e7275d2ba6ce6f5534796171

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdc0ac542a2d3b0f03acc1052eaee935

SHA1
5ae474b549e20c67c2051b2eecb9ca26c69ff8cb

SHA256
73d67babe5f0d45745cf8a0769daa26b9abc8eb44710c463998ddba8a824dfdd

SHA512
2daacbd190ed318b76914da4d37a458962be4496a2ffba389c3841567bd4212dc6ef8e9798e823f3efd424b089990ba4a1417be5aa6c6f4e2d6bf21c3cbb3865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bbd1319928c1c3b422a464b0f166d3f

SHA1
6c57b7d21b42f2d9491fde14a480b8aad76a5749

SHA256
547d301a0440125b7cd741865bb1dffad16b5fb790c5a080da1e0502ef5dd32e

SHA512
8a9760c31b5a632c55e1fe30bb8e199b6676959e1d66514e948730b3e7ef42fe4e253e7f548652eacb0d69a23b4d1d58965d5695a392ef14f2aadf1b29ec8c57

Download Submit