cf832f9d5346f448cc094fa3089ada2a22ced2c6942b05779d9acdda0b348ed3

Analysis

max time kernel
126s
max time network
214s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ba208ff2ac20e3c619a0790dc905337.html
Size

10KB
MD5

0ba208ff2ac20e3c619a0790dc905337
SHA1

755957a5e6a7570cc20bbf07cc08a50dc9dbeb9d
SHA256

cf832f9d5346f448cc094fa3089ada2a22ced2c6942b05779d9acdda0b348ed3
SHA512

81609482c4c2ef39bf87be66423d0b7e07da5f18f1993268772021f182019f6a649651c72933838458caa6f909492136e3bc3c596396ff5978d924b53e8f94c2
SSDEEP

192:SyS6Vw1x5Ou4qk0N5k4QXVROalaZC4siQx2QMRQrDQGVQi8QgHh0QHPQzEiuQC8h:SyS6Vw1x5Ou4qk0PPmwNC4B62dRgDFVn

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5027d3cd5b37da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000005a997e53a02e4a90cc4e820b7f842eb816976c618e5a31951006f47509e4fae1000000000e8000000002000020000000668760a25ea9dca9f35746fb9d47976dc58a459965a7eceb4f3b59b750e961e39000000042740706df3a34b13c8c72bf3b1146938a81b23ab59773d1e00d85c745e3efdeb6d2a4b8ab96c80d4ddc623d40123f2acc5e98d6291ad400a72f73ed02dc6869487bb70f6cebb2e48744eab226a19b4febd65e0037fab199cc1e0932920fd2613b53f0a03219b811772683425077b3c0b2a0f62debcb4b0e8577d34cea48e6960f5e635c10d08bdb625ed722292614b2400000001e14a4896ff8a67a2833130fb43ae103cf7b9bf6355b422dc02a61ffc1a7cfac0e36019b150e04aa5e1102d8b572dbe9b45b38cce9a05e2a27d150ce0aae7005	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409688874"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000b10b2cf807616b0f7e9801872151c81f53116fd7b6556acf9f65346b90ea1d70000000000e80000000020000200000004b8d17461ecd9397d06b06f4950098c4319ae2274d4fbc7d6413d05a618d877720000000c7ec960f1613791abd272e419b3ce731cd1a5ce9484b5bf5d6dcab89133807ab40000000c5b8b2ec0da4d76f3192b0650c5586eadd7f72101c2991a8dba5cffa329bd814df907db776c80ac38a924d14bfd4dfb4cc59cdcbf1c1b4ef7d749db899cff43e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F7A59A90-A34E-11EE-8CED-6A1079A24C90} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2036	2288	iexplore.exe	30
PID 2288 wrote to memory of 2036	2288	iexplore.exe	30
PID 2288 wrote to memory of 2036	2288	iexplore.exe	30
PID 2288 wrote to memory of 2036	2288	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ba208ff2ac20e3c619a0790dc905337.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38d5e4a19c7f278f25ece5f33b213231

SHA1
57e326b9f69205e55ebbf4a4a3fa0017f7c7463b

SHA256
70c6f473c2e8a4224531540d3cbc849338f475c10041a03a586fc115bd702801

SHA512
85e87aa6cd7b583ec37521cb24dd182f389feefcc20e80971417f170aba221e950dabe2c827a1bb1569b6b0bcad7eed0d9c3680fb5e5bd1ed59f1e5d3ba888a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b171c7a212b91e097beef9a8dc43d93c

SHA1
8b5e6aa117180af5afdac77b1da36592aaa69887

SHA256
310f7fb6e69e26b80e76e5b21dbe54102059bca58e5af9c7bd47bc7a71cdb3bd

SHA512
b58d5996af6e269ad0058b35f6f0586a17f7d2c8cfd6af7fcb42dccd6e38d2ddd5b48736f73737a86e744632f4295f10b5e0e929f5f61001542ca62733581461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc4f1d85bcf099b69fa3194277f48574

SHA1
6894a12dc7e23cab7e9ee8626149b5cecd4846d1

SHA256
f4f5d171d814a2fc513289cb706eee5592dc6568053aaa89024b57ae27240758

SHA512
c7de26c7d2a16ece469728fa3092ca5090b6259acea76835951e20d1f4e75bb8d815eb5dad31a26ff805c264ac34f9e118b88450a0598bb21276c9102e8177be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba7104f2aecb86a1216888280d2557c8

SHA1
7461da5aca721e56a157e6a5a6acc840ab6deb04

SHA256
bfd9621d0e3c8ffa3f91f6454ca3f5be96c7077c129ee235421898bb39f3d525

SHA512
adba37ce836ab2c811efd2b7912c78d31673bbdf4ecf4f4547187eb9837828c22fa0112adc14feb3ef0961ba84d7e6b5551bc3aed1d8ff550f66b8224bb3050f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f383f460084ccf01b9a517f81ab9217

SHA1
d8643b2a6563ac76bef8ee79c018514929ad395c

SHA256
843d5f2ccb18c1c6e1e34ad353d59349cfea5588ba987ad7907430ca69b773bb

SHA512
6ce044cafa3c87cdc7f497ad4ee14467840a266f93233f0fd0f47e4c5fbf59d6aef8ebd8546dbd1b978e8d326b9816e0c8f30355dadfa429f59dc75d75edb525

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ff4f0191888b1fd89ed3a3f55240430

SHA1
5bd2503b2ca291b96b9ba2a79aa7c59f922d1438

SHA256
a6b775b7b81d5abaab4e46589dc00c6a8dc4dc5b089873fef1207a3e2f04a710

SHA512
d1496d87f677f715abb5e4ba494a4ac18e1ec04fd041057bb4c4ffd76896bdbf6d745fda994beb6b9ad6a54b02869224e7de882c42daa5b3a76019d6f497451f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86f6552daeececccadaba4d6cda831cc

SHA1
df7b9c379631f4d0b327be4502eba13f2b3829ee

SHA256
4b15972a45289d14690a0b579be6c87353df81f39a742a51eb9a6400bc4de5e2

SHA512
97e6e2fa0febc6adae6828d2e2644e08ea9eda05587690c79bd7dae8935e1b1281cf784a3d9cf3871cb829458551f0a5a067089a6d3326f33ddf131110013460

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
015b8fd01feeaf8c9c0167997c3aaca1

SHA1
a285b6f84f2349543328ad5f84111bf0ab9937c3

SHA256
20fe7e96a940085c1195a18c32cd018cdf854f248c761a75d7e381eb0bfdfc82

SHA512
0497e810fc7e8247b2ab92e0b562a08480574054e5179028161032e3e022f047ca00afbfcb285b09d3c3cce62d1b3b7e9652d9b5d69cb73004d680797bf0bdc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a25a513227e38e3034472bb246582fa

SHA1
ba9b7e60cac361a5dca3edef7cd7a2e266697003

SHA256
3080faf964f03d33e5f089cc772b63aaeefd400a9514132bf1f80f43c9392eed

SHA512
d4c917b5d4f580466f0759b9bbbad18f8af227531a0165201f9bc66d297f6ab2e9fd905b8fbedf9530a8941ffb9a509c3721c060ab4f56f2c1d94f4a86621bc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56e1ddf7d4c378f1398d97187f243fc5

SHA1
11376403cd7caedc008082ac0b4a81cd0cedb9fc

SHA256
9e6f3f544a8f76e4af2b05649b926e4fd7cf51f0b03576ff523db774323cd361

SHA512
3fadfe1d229510786204f672b7c134923d3bc748d7bf16eed5532cdddbf576692e0acb163bafc4e6b867746d28bc5d2a7825db5d12404e41ca2c3a764dc6ce09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae850de282e047cd4b14f8b29144a8b8

SHA1
75b5658d2c06e3d753283bd71328076b8bc684e7

SHA256
72969ae1baddb2bff166f3467623ded7aa645841f18e369424995b9d9be10662

SHA512
65040ff7b280f6c88d1ade0df5a7c163bd2d6b3cfe816a696c8e2bfe4924b062c336130d3d48f375a8f965d9eca9538f06cf7e164927559d75bab28f0827ead2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a981852b3f6be96042f5cf5892aa0f54

SHA1
aafaa9dec30b6368c530bd536cb8cfac5b4e061a

SHA256
6477c1f0d2919765273c5a5f838b109e5c53edcb8fc72f499684ac348afec11b

SHA512
635815b8b856e9bf6f6843c566ad0168f5d34123a65cf4fb6953df9b6ccc451f99ed441e62a80fd01e1c6298c1d5a5825abaaefb3f03aa095a0de44b2d6ddece

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC62D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD3D9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit